xmrig | 53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8

Analysis

max time kernel
120s
max time network
122s
platform
windows10_x64
resource
win10v20210410
submitted
13-05-2021 12:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
Size

572KB
MD5

2fdf89edcb303f8935bbd1f7c3cf32d1
SHA1

a40a622c4de6c7d2e21b1215430ff07a43fd02eb
SHA256

53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8
SHA512

a5e6b3098aeaae508cf99c38d1abd7ada60a127f7b1006f1ed65dc48fa4f955e8c90436b7d1f5163ec77e277fef09935a656f8a47c51787148305d1f8fd78bc0

Score

10^/10

xmrig miner spyware stealer

Malware Config

Signatures

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 2 IoCs

Processes:

53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe

description	ioc	process
File opened for modification	C:\Windows\System32\TsWpfWrp.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\SysWOW64\TsWpfWrp.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe

Drops file in Program Files directory 1 IoCs

Processes:

53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe

Drops file in Windows directory 64 IoCs

Processes:

53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ComSvcConfig.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\MSBuild.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx-dfsvc_b03f5f7f11d50a3a_10.0.15063.0_none_7ba4fd2e9a959f80\dfsvc.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\msil_comsvcconfig_b03f5f7f11d50a3a_10.0.15063.0_none_a4d909d870ff99e0\ComSvcConfig.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_10.0.15063.0_none_8a6a790ce079de7f\aspnet_compiler.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.15063.0_none_7b0b6115a0fbb545\aspnet_regbrowsers.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx-jsc_b03f5f7f11d50a3a_10.0.15063.0_none_f9b02daf974f6d24\jsc.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_10.0.15063.0_none_a06ab765d5c4f407\DataSvcUtil.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.15063.0_none_c2c00e8330a5adbb\PresentationFontCache.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\x86_msbuild_b03f5f7f11d50a3a_10.0.15063.0_none_3a83aad74d9d5e68\MSBuild.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx35linq-addinprocess_31bf3856ad364e35_10.0.15063.0_none_41ab04018589ba56\AddInProcess.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\msil_edmgen_b77a5c561934e089_10.0.15063.0_none_80cd4dc1343c6644\EdmGen.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\msil_ieexec_b03f5f7f11d50a3a_10.0.15063.0_none_3830d2bda4126472\IEExec.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\x86_wpf-xamlviewer_31bf3856ad364e35_10.0.15063.0_none_0b038a36fd5e2ac1\XamlViewer_v0300.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dfsvc.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.15063.0_none_9223897625b59d49\AddInProcess32.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\amd64_regasm_b03f5f7f11d50a3a_10.0.15063.0_none_88b780059d6de6e9\RegAsm.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.15063.0_none_c17d729c441d6e56\aspnet_regsql.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_10.0.15063.0_none_f2d6740039213562\MSBuild.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_10.0.15063.0_none_37cf9bf85378124e\ComSvcConfig.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\amd64_wcf-smsvchost_b03f5f7f11d50a3a_10.0.15063.0_none_acba7ecbeae0a029\SMSvcHost.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_10.0.15063.0_none_dd7a076377c8505e\CasPol.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx35linq-addinutil_31bf3856ad364e35_10.0.15063.0_none_dc3212611c2a948b\AddInUtil.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\msil_addinprocess_b77a5c561934e089_10.0.15063.0_none_ac938d72130f980b\AddInProcess.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\x86_aspnet_regsql_b03f5f7f11d50a3a_10.0.15063.0_none_092aa9735899975c\aspnet_regsql.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\x86_msbuild_b03f5f7f11d50a3a_3.5.15063.0_none_244e49cb7ea268e6\MSBuild.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\x86_regasm_b03f5f7f11d50a3a_10.0.15063.0_none_d064b6dcb1ea0fef\RegAsm.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\amd64_wcf-servicemodelreg_b03f5f7f11d50a3a_10.0.15063.0_none_25f0a4bdfb1087e3\ServiceModelReg.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\msil_smsvchost_b03f5f7f11d50a3a_10.0.15063.0_none_cbaa590df0d6f1ef\SMSvcHost.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
File opened for modification	C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_3.5.15063.0_none_806ce54f36ffda1c\MSBuild.exe	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.exe

description	pid	process	target process
PID 3176 wrote to memory of 1804	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3176 wrote to memory of 1804	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 1804 wrote to memory of 2484	1804	csc.exe	cvtres.exe
PID 1804 wrote to memory of 2484	1804	csc.exe	cvtres.exe
PID 3176 wrote to memory of 2812	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3176 wrote to memory of 2812	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 2812 wrote to memory of 3788	2812	csc.exe	cvtres.exe
PID 2812 wrote to memory of 3788	2812	csc.exe	cvtres.exe
PID 3176 wrote to memory of 1116	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3176 wrote to memory of 1116	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 1116 wrote to memory of 2128	1116	csc.exe	cvtres.exe
PID 1116 wrote to memory of 2128	1116	csc.exe	cvtres.exe
PID 3176 wrote to memory of 3896	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3176 wrote to memory of 3896	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3896 wrote to memory of 204	3896	csc.exe	cvtres.exe
PID 3896 wrote to memory of 204	3896	csc.exe	cvtres.exe
PID 3176 wrote to memory of 2148	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3176 wrote to memory of 2148	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 2148 wrote to memory of 2076	2148	csc.exe	cvtres.exe
PID 2148 wrote to memory of 2076	2148	csc.exe	cvtres.exe
PID 3176 wrote to memory of 3508	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3176 wrote to memory of 3508	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3508 wrote to memory of 2812	3508	csc.exe	cvtres.exe
PID 3508 wrote to memory of 2812	3508	csc.exe	cvtres.exe
PID 3176 wrote to memory of 972	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3176 wrote to memory of 972	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 972 wrote to memory of 992	972	csc.exe	cvtres.exe
PID 972 wrote to memory of 992	972	csc.exe	cvtres.exe
PID 3176 wrote to memory of 3960	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3176 wrote to memory of 3960	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3960 wrote to memory of 1828	3960	csc.exe	cvtres.exe
PID 3960 wrote to memory of 1828	3960	csc.exe	cvtres.exe
PID 3176 wrote to memory of 3224	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3176 wrote to memory of 3224	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3224 wrote to memory of 2528	3224	csc.exe	cvtres.exe
PID 3224 wrote to memory of 2528	3224	csc.exe	cvtres.exe
PID 3176 wrote to memory of 2076	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3176 wrote to memory of 2076	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 2076 wrote to memory of 3976	2076	csc.exe	cvtres.exe
PID 2076 wrote to memory of 3976	2076	csc.exe	cvtres.exe
PID 3176 wrote to memory of 3612	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3176 wrote to memory of 3612	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3612 wrote to memory of 3720	3612	csc.exe	cvtres.exe
PID 3612 wrote to memory of 3720	3612	csc.exe	cvtres.exe
PID 3176 wrote to memory of 3404	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3176 wrote to memory of 3404	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3404 wrote to memory of 212	3404	csc.exe	cvtres.exe
PID 3404 wrote to memory of 212	3404	csc.exe	cvtres.exe
PID 3176 wrote to memory of 2192	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3176 wrote to memory of 2192	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 2192 wrote to memory of 2264	2192	csc.exe	cvtres.exe
PID 2192 wrote to memory of 2264	2192	csc.exe	cvtres.exe
PID 3176 wrote to memory of 4012	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3176 wrote to memory of 4012	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 4012 wrote to memory of 1864	4012	csc.exe	cvtres.exe
PID 4012 wrote to memory of 1864	4012	csc.exe	cvtres.exe
PID 3176 wrote to memory of 2792	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3176 wrote to memory of 2792	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 2792 wrote to memory of 2072	2792	csc.exe	cvtres.exe
PID 2792 wrote to memory of 2072	2792	csc.exe	cvtres.exe
PID 3176 wrote to memory of 3384	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3176 wrote to memory of 3384	3176	53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe	csc.exe
PID 3384 wrote to memory of 212	3384	csc.exe	cvtres.exe
PID 3384 wrote to memory of 212	3384	csc.exe	cvtres.exe

C:\Users\Admin\AppData\Local\Temp\53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe
"C:\Users\Admin\AppData\Local\Temp\53b83ed3dae3609fe66aee918a04a0f51795cef0255f5262ce02c133cf3d9db8.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3176

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\6iecw7h7.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1544.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1543.tmp"
3⤵
PID:2484

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u3gcdaja.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:2812

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES161F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC160E.tmp"
3⤵
PID:3788

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ey8pnceg.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:1116

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2707.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2706.tmp"
3⤵
PID:2128

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kpc3yrwk.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:3896

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES27C2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC27C1.tmp"
3⤵
PID:204

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\-hbwsegx.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:2148

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2B1E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2B1D.tmp"
3⤵
PID:2076

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\luvx5leu.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:3508

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2BD9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2BD8.tmp"
3⤵
PID:2812

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\df-bdaym.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:972

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2CD3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2CD2.tmp"
3⤵
PID:992

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ar8pejyd.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:3960

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2D8F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2D8E.tmp"
3⤵
PID:1828

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ehktacza.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:3224

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2F35.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2F34.tmp"
3⤵
PID:2528

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ss-0d-qi.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:2076

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2FF0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2FEF.tmp"
3⤵
PID:3976

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\_sw3i-ua.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:3612

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES30DA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC30CA.tmp"
3⤵
PID:3720

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4f7ga6of.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:3404

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3186.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3185.tmp"
3⤵
PID:212

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gvqenhts.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:2192

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES32CE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC32CD.tmp"
3⤵
PID:2264

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oamyytan.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:4012

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES33B9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC33B8.tmp"
3⤵
PID:1864

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jiem2gte.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES34A3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3493.tmp"
3⤵
PID:2072

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ehh4zqkk.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:3384

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES354F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC354E.tmp"
3⤵
PID:212

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vnzbmpqw.cmdline"
2⤵
PID:3988

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3705.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3704.tmp"
3⤵
PID:2152

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mex1-tel.cmdline"
2⤵
PID:2264

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES37B0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC37A0.tmp"
3⤵
PID:1216

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ovnekz-l.cmdline"
2⤵
PID:812

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4117.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4116.tmp"
3⤵
PID:2852

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\av-k8r41.cmdline"
2⤵
PID:2196

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES41B3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC41B2.tmp"
3⤵
PID:992

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\etlt2b3d.cmdline"
2⤵
PID:204

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES427E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC427D.tmp"
3⤵
PID:1996

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gn0fcqq6.cmdline"
2⤵
PID:2484

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES430B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC430A.tmp"
3⤵
PID:2124

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\30cndha1.cmdline"
2⤵
PID:1216

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4405.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4404.tmp"
3⤵
PID:1848

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wq0eytak.cmdline"
2⤵
PID:3880

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES44A1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4490.tmp"
3⤵
PID:3224

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mhujre3a.cmdline"
2⤵
PID:3968

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES458B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC458A.tmp"
3⤵
PID:2076

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pxir9f7r.cmdline"
2⤵
PID:3120

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4637.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4636.tmp"
3⤵
PID:3788

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eatex-_c.cmdline"
2⤵
PID:3724

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES46F3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC46F2.tmp"
3⤵
PID:1128

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\krxbhc0-.cmdline"
2⤵
PID:1140

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES477F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC477E.tmp"
3⤵
PID:3928

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kdktmmte.cmdline"
2⤵
PID:1828

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4879.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4878.tmp"
3⤵
PID:3976

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kmrw1_fn.cmdline"
2⤵
PID:1676

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4916.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4905.tmp"
3⤵
PID:812

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qrxr8sj-.cmdline"
2⤵
PID:1792

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A00.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC49FF.tmp"
3⤵
PID:2268

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\etfdvuzg.cmdline"
2⤵
PID:2148

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A8D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4A8C.tmp"
3⤵
PID:972

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s3asy02i.cmdline"
2⤵
PID:3508

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B58.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4B57.tmp"
3⤵
PID:3868

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nlsy7dix.cmdline"
2⤵
PID:1140

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4BF4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4BF3.tmp"
3⤵
PID:3584

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\reeoygw1.cmdline"
2⤵
PID:1848

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4CBF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4CBE.tmp"
3⤵
PID:2488

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sodwj1uo.cmdline"
2⤵
PID:2344

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D5B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4D5A.tmp"
3⤵
PID:2196

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y6uwghci.cmdline"
2⤵
PID:2792

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E46.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4E35.tmp"
3⤵
PID:204

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ruxczemk.cmdline"
2⤵
PID:3792

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4EB3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4EB2.tmp"
3⤵
PID:1948

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\7b0kr9nx.cmdline"
2⤵
PID:1204

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4F7E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4F7D.tmp"
3⤵
PID:2832

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\9a8owt1w.cmdline"
2⤵
PID:3976

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4FFB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4FFA.tmp"
3⤵
PID:3184

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1tzxsgdx.cmdline"
2⤵
PID:2488

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5134.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5123.tmp"
3⤵
PID:1676

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\6djlxequ.cmdline"
2⤵
PID:2876

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES51D0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC51CF.tmp"
3⤵
PID:2532

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yug2xou7.cmdline"
2⤵
PID:3384

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES52CA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC52C9.tmp"
3⤵
PID:1804

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rvlv9eme.cmdline"
2⤵
PID:2208

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5366.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5356.tmp"
3⤵
PID:1948

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s07swyd-.cmdline"
2⤵
PID:2124

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES547F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC547E.tmp"
3⤵
PID:3752

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\btjmg8tx.cmdline"
2⤵
PID:2272

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES552B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC552A.tmp"
3⤵
PID:1640

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\odtkrszf.cmdline"
2⤵
PID:2268

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES55F6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC55F5.tmp"
3⤵
PID:1220

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uqwh7vkd.cmdline"
2⤵
PID:3464

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5664.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5663.tmp"
3⤵
PID:3984

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w7zikfuw.cmdline"
2⤵
PID:1264

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES575E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC574D.tmp"
3⤵
PID:3384

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\6jgxye6h.cmdline"
2⤵
PID:3508

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES57DB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC57DA.tmp"
3⤵
PID:972

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mbgkg6fy.cmdline"
2⤵
PID:1888

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES58B6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC58B5.tmp"
3⤵
PID:3988

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1abk1mkp.cmdline"
2⤵
PID:1124

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES59BF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC59BE.tmp"
3⤵
PID:3892

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g2zzeiih.cmdline"
2⤵
PID:3120

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5AAA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5AA9.tmp"
3⤵
PID:1640

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rnyyjrev.cmdline"
2⤵
PID:1440

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5B36.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5B26.tmp"
3⤵
PID:1216

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xeu4p7ws.cmdline"
2⤵
PID:3772

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5BE2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5BE1.tmp"
3⤵
PID:2536

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f-v-pxyk.cmdline"
2⤵
PID:2196

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5C5F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5C5E.tmp"
3⤵
PID:2548

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\khir4vvs.cmdline"
2⤵
PID:2148

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5D3A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5D29.tmp"
3⤵
PID:1276

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1mxdzrzz.cmdline"
2⤵
PID:3900

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5D98.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5D97.tmp"
3⤵
PID:1192

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rm29hpr8.cmdline"
2⤵
PID:212

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5EB1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5EB0.tmp"
3⤵
PID:744

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o1bscup8.cmdline"
2⤵
PID:1208

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5F2E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5F2D.tmp"
3⤵
PID:3604

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ed_ombpa.cmdline"
2⤵
PID:3224

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6009.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6008.tmp"
3⤵
PID:1440

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kcgt8auu.cmdline"
2⤵
PID:1996

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6095.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6085.tmp"
3⤵
PID:3772

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pevnnxb4.cmdline"
2⤵
PID:992

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES61ED.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC61EC.tmp"
3⤵
PID:2196

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uozln-x-.cmdline"
2⤵
PID:1020

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES627A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6269.tmp"
3⤵
PID:2148

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\9yrpjf-c.cmdline"
2⤵
PID:2840

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6354.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6353.tmp"
3⤵
PID:1204

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mlne02yr.cmdline"
2⤵
PID:196

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES63E1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC63E0.tmp"
3⤵
PID:2852

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tbxfxfff.cmdline"
2⤵
PID:3440

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES64DB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC64DA.tmp"
3⤵
PID:1208

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pca8e1bv.cmdline"
2⤵
PID:1008

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6558.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6557.tmp"
3⤵
PID:3968

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sho9trwx.cmdline"
2⤵
PID:3224

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6623.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6622.tmp"
3⤵
PID:2848

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\d71ovijg.cmdline"
2⤵
PID:1216

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES66A0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC669F.tmp"
3⤵
PID:1264

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uln_4se1.cmdline"
2⤵
PID:3788

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES676B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC676A.tmp"
3⤵
PID:972

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gige8jqt.cmdline"
2⤵
PID:3928

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6817.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6816.tmp"
3⤵
PID:1192

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vwvb9_xv.cmdline"
2⤵
PID:3752

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6901.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6900.tmp"
3⤵
PID:3376

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wb10kjrv.cmdline"
2⤵
PID:196

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES698E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC697D.tmp"
3⤵
PID:3184

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uhuow-lx.cmdline"
2⤵
PID:856

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6A4A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6A49.tmp"
3⤵
PID:1676

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2qys-vmk.cmdline"
2⤵
PID:1008

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6AD6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6AD5.tmp"
3⤵
PID:3384

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oizajkrk.cmdline"
2⤵
PID:752

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6BB1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6BB0.tmp"
3⤵
PID:2196

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gcseldzb.cmdline"
2⤵
PID:1996

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6C2E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6C1D.tmp"
3⤵
PID:972

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\otirbomp.cmdline"
2⤵
PID:3960

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6D28.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6D27.tmp"
3⤵
PID:1192

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r71csj9_.cmdline"
2⤵
PID:3900

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6DC4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6DC3.tmp"
3⤵
PID:3376

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ugjbalph.cmdline"
2⤵
PID:3516

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6E8F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6E8E.tmp"
3⤵
PID:3184

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ziytyymb.cmdline"
2⤵
PID:3952

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6F99.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6F98.tmp"
3⤵
PID:1676

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jzkz-phd.cmdline"
2⤵
PID:2872

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7083.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7082.tmp"
3⤵
PID:2848

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\39gt83m8.cmdline"
2⤵
PID:1440

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7100.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC70FF.tmp"
3⤵
PID:1264

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zkxnsktr.cmdline"
2⤵
PID:3224

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES721A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7209.tmp"
3⤵
PID:972

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uoyhyjur.cmdline"
2⤵
PID:1864

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7297.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7296.tmp"
3⤵
PID:812

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\9ppyzzeu.cmdline"
2⤵
PID:2780

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES73A0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC739F.tmp"
3⤵
PID:744

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\deqyj3_h.cmdline"
2⤵
PID:1020

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES742D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC742C.tmp"
3⤵
PID:3184

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\62jkfo4r.cmdline"
2⤵
PID:1124

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7527.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7526.tmp"
3⤵
PID:1676

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kcg0in3_.cmdline"
2⤵
PID:1640

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES75D3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC75D2.tmp"
3⤵
PID:2792

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\9bed7tdq.cmdline"
2⤵
PID:3440

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES76AD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC76AC.tmp"
3⤵
PID:204

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\msilq8ea.cmdline"
2⤵
PID:1832

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7779.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7778.tmp"
3⤵
PID:2196

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vhzeut_2.cmdline"
2⤵
PID:3224

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7882.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7881.tmp"
3⤵
PID:3708

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nwkyd9fw.cmdline"
2⤵
PID:3464

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES791E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC791D.tmp"
3⤵
PID:3788

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\8ciln8ix.cmdline"
2⤵
PID:3792

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7A76.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7A75.tmp"
3⤵
PID:1140

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\q-m27bfk.cmdline"
2⤵
PID:1020

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7AE4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7AE3.tmp"
3⤵
PID:3752

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pdc9wim_.cmdline"
2⤵
PID:212

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7BBE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7BBD.tmp"
3⤵
PID:196

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b5eerdth.cmdline"
2⤵
PID:2264

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7C89.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7C79.tmp"
3⤵
PID:2020

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\h-ihlgvf.cmdline"
2⤵
PID:3440

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7E4F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7E4E.tmp"
3⤵
PID:2148

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ltlih2ll.cmdline"
2⤵
PID:1832

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7ECC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7ECB.tmp"
3⤵
PID:2260

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\idcc_d8s.cmdline"
2⤵
PID:2256

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7FD5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7FD4.tmp"
3⤵
PID:1216

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ghz6bpja.cmdline"
2⤵
PID:2852

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8091.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8090.tmp"
3⤵
PID:3960

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mc2w6_58.cmdline"
2⤵
PID:1140

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES81BA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC81B9.tmp"
3⤵
PID:3668

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v-p9liha.cmdline"
2⤵
PID:3752

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8237.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8236.tmp"
3⤵
PID:3516

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\84octfiu.cmdline"
2⤵
PID:4012

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8340.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC833F.tmp"
3⤵
PID:3952

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jdcvqzq2.cmdline"
2⤵
PID:2240

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES83FC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC83EB.tmp"
3⤵
PID:3880

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ku8bk143.cmdline"
2⤵
PID:2792

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8553.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8552.tmp"
3⤵
PID:2064

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pcsxalqe.cmdline"
2⤵
PID:1804

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES860F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC860E.tmp"
3⤵
PID:1792

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ed4hrltu.cmdline"
2⤵
PID:2484

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8E3D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8E2C.tmp"
3⤵
PID:4068

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ybqegm0p.cmdline"
2⤵
PID:3508

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8EC9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8EC8.tmp"
3⤵
PID:2320

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\_iwznhjp.cmdline"
2⤵
PID:3276

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9997.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9996.tmp"
3⤵
PID:1140

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aqh_-szr.cmdline"
2⤵
PID:3184

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A52.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9A51.tmp"
3⤵
PID:3752

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\avldwvmg.cmdline"
2⤵
PID:3120

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA465.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA464.tmp"
3⤵
PID:212

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mpx1gy4x.cmdline"
2⤵
PID:2176

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA510.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA50F.tmp"
3⤵
PID:3384

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\_2jahg6z.cmdline"
2⤵
PID:3984

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA649.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA648.tmp"
3⤵
PID:2196

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4qr8ycr0.cmdline"
2⤵
PID:2848

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA6E5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA6D5.tmp"
3⤵
PID:3708

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vaztcrcr.cmdline"
2⤵
PID:2548

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA7C0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA7BF.tmp"
3⤵
PID:3676

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cwldr6_e.cmdline"
2⤵
PID:1192

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA84D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA83C.tmp"
3⤵
PID:1216

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xce7pij6.cmdline"
2⤵
PID:3404

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA966.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA965.tmp"
3⤵
PID:3960

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2cckxwi5.cmdline"
2⤵
PID:2272

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA9F2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA9E2.tmp"
3⤵
PID:1124

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sxijwps0.cmdline"
2⤵
PID:2104

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAAEC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAAEB.tmp"
3⤵
PID:3184

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\phmyzrac.cmdline"
2⤵
PID:1640

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB89.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAB88.tmp"
3⤵
PID:212

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tpgmsm6g.cmdline"
2⤵
PID:3968

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD6D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAD6C.tmp"
3⤵
PID:2176

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ovnozbtb.cmdline"
2⤵
PID:2264

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESADFA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCADF9.tmp"
3⤵
PID:3984

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s2v14d7o.cmdline"
2⤵
PID:752

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC431.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC421.tmp"
3⤵
PID:2848

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gx3oyfth.cmdline"
2⤵
PID:356

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC4AE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC4AD.tmp"
3⤵
PID:2660

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\18mlchwo.cmdline"
2⤵
PID:2548

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC599.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC598.tmp"
3⤵
PID:1192

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b88bwudo.cmdline"
2⤵
PID:4068

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC635.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC634.tmp"
3⤵
PID:3404

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\56xs3r2u.cmdline"
2⤵
PID:812

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC829.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC828.tmp"
3⤵
PID:2208

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4hpug59c.cmdline"
2⤵
PID:1124

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC8C5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC8C4.tmp"
3⤵
PID:2104

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\snpvjxhc.cmdline"
2⤵
PID:3724

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC9A0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC99F.tmp"
3⤵
PID:1640

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3aqww-l-.cmdline"
2⤵
PID:3952

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCA2C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCA2B.tmp"
3⤵
PID:3384

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\-nr47gwv.cmdline"
2⤵
PID:2176

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCB17.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCB16.tmp"
3⤵
PID:2264

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sjpnt7in.cmdline"
2⤵
PID:2536

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCBB3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCBB2.tmp"
3⤵
PID:752

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\8rvzglmq.cmdline"
2⤵
PID:2288

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCCDC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCCDB.tmp"
3⤵
PID:356

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vutuyimj.cmdline"
2⤵
PID:3988

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCD78.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCD68.tmp"
3⤵
PID:3224

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\27greplr.cmdline"
2⤵
PID:2884

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE63.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCE52.tmp"
3⤵
PID:3960

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g-lcuut_.cmdline"
2⤵
PID:3792

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCEEF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCEEE.tmp"
3⤵
PID:3276

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2rc2k2og.cmdline"
2⤵
PID:1204

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCFE9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCFD9.tmp"
3⤵
PID:3184

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cq7ozxii.cmdline"
2⤵
PID:472

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD076.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD075.tmp"
3⤵
PID:212

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\02jxin1f.cmdline"
2⤵
PID:2020

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD17F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD17E.tmp"
3⤵
PID:3772

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c0_cy9cf.cmdline"
2⤵
PID:972

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD1FC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD1FB.tmp"
3⤵
PID:1936

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\8xjdqbqk.cmdline"
2⤵
PID:2064

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD5C5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD5C4.tmp"
3⤵
PID:2536

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cdxwmkhv.cmdline"
2⤵
PID:1028

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD661.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD660.tmp"
3⤵
PID:2288

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eyyvkxgu.cmdline"
2⤵
PID:1264

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD76B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD76A.tmp"
3⤵
PID:1276

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2hgyercv.cmdline"
2⤵
PID:3036

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD7F8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD7E7.tmp"
3⤵
PID:2852

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c3hslem8.cmdline"
2⤵
PID:3720

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD940.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD93F.tmp"
3⤵
PID:2272

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aapwo-tn.cmdline"
2⤵
PID:2208

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDA3A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDA39.tmp"
3⤵
PID:3376

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wfa3soka.cmdline"
2⤵
PID:2104

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDB43.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDB33.tmp"
3⤵
PID:196

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wa0s1zrv.cmdline"
2⤵
PID:1640

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDBD0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDBCF.tmp"
3⤵
PID:2228

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nktsj3h2.cmdline"
2⤵
PID:3384

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDCDA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDCD9.tmp"
3⤵
PID:972

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dwadv6sd.cmdline"
2⤵
PID:1948

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDD86.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDD75.tmp"
3⤵
PID:3708

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fe3iaruw.cmdline"
2⤵
PID:1832

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE8F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDE8E.tmp"
3⤵
PID:1028

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eaw4kayw.cmdline"
2⤵
PID:1224

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDF89.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDF88.tmp"
3⤵
PID:1264

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hc0i1ptm.cmdline"
2⤵
PID:1192

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE14E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE14D.tmp"
3⤵
PID:3036

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\l2ovcr7h.cmdline"
2⤵
PID:3888

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE1DB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE1DA.tmp"
3⤵
PID:2884

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fel1meom.cmdline"
2⤵
PID:744

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE2F4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE2F3.tmp"
3⤵
PID:2208

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m-gifxua.cmdline"
2⤵
PID:2268

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE381.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE380.tmp"
3⤵
PID:2104

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xqsu6hmx.cmdline"
2⤵
PID:1676

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE45C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE45B.tmp"
3⤵
PID:1640

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\q4lkcjre.cmdline"
2⤵
PID:204

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE517.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE516.tmp"
3⤵
PID:1440

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mhux-dq1.cmdline"
2⤵
PID:1784

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF0B0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF0AF.tmp"
3⤵
PID:2284

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b1uhgbdh.cmdline"
2⤵
PID:2260

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF13C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF13B.tmp"
3⤵
PID:3688

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cad4q0er.cmdline"
2⤵
PID:2676

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF256.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF245.tmp"
3⤵
PID:2288

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\umrspjor.cmdline"
2⤵
PID:3988

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF2F2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF2F1.tmp"
3⤵
PID:3036

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gh4hprfl.cmdline"
2⤵
PID:3960

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF3FC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF3EB.tmp"
3⤵
PID:416

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z8ok1qao.cmdline"
2⤵
PID:3976

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF488.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF487.tmp"
3⤵
PID:3516

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qmlosp6d.cmdline"
2⤵
PID:3184

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF5B1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF5B0.tmp"
3⤵
PID:3376

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tippsxba.cmdline"
2⤵
PID:2200

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF63E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF63D.tmp"
3⤵
PID:2344

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\69hbm0y4.cmdline"
2⤵
PID:3772

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF718.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF717.tmp"
3⤵
PID:2792

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vgznarrx.cmdline"
2⤵
PID:3340

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF7B5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF7B4.tmp"
3⤵
PID:3984

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jj6qyf6s.cmdline"
2⤵
PID:2292

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF8AF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF8AE.tmp"
3⤵
PID:1792

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cpgrcg4j.cmdline"
2⤵
PID:2684

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF94B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF94A.tmp"
3⤵
PID:2484

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3vwfx7yo.cmdline"
2⤵
PID:1276

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFA35.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFA34.tmp"
3⤵
PID:2992

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\slhmbods.cmdline"
2⤵
PID:2320

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFAD2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFAD1.tmp"
3⤵
PID:4068

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1wppgnba.cmdline"
2⤵
PID:2840

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFBBC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFBAB.tmp"
3⤵
PID:812

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vaflpvzn.cmdline"
2⤵
PID:2680

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFC39.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFC38.tmp"
3⤵
PID:2204

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w3pyyw15.cmdline"
2⤵
PID:3892

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFDC0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFDAF.tmp"
3⤵
PID:3884

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pqk4yb7q.cmdline"
2⤵
PID:1496

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE5C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFE5B.tmp"
3⤵
PID:3952

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y35bxgxq.cmdline"
2⤵
PID:2200

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF65.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFF64.tmp"
3⤵
PID:2228

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qzxm23se.cmdline"
2⤵
PID:2824

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1.tmp"
3⤵
PID:364

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0no_qehq.cmdline"
2⤵
PID:3708

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCEB.tmp"
3⤵
PID:2316

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\op9yzzha.cmdline"
2⤵
PID:356

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES179.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC178.tmp"
3⤵
PID:4036

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xuriudrs.cmdline"
2⤵
PID:2548

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES35D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC35C.tmp"
3⤵
PID:1260

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zylbtapi.cmdline"
2⤵
PID:1492

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3CA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3C9.tmp"
3⤵
PID:3788

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\8pzphwuy.cmdline"
2⤵
PID:3036

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA91.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA80.tmp"
3⤵
PID:2124

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mngn8ll8.cmdline"
2⤵
PID:416

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB0E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB0D.tmp"
3⤵
PID:3404

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s49owe77.cmdline"
2⤵
PID:744

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC17.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC16.tmp"
3⤵
PID:748

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zev1h8oj.cmdline"
2⤵
PID:2208

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCA4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCA3.tmp"
3⤵
PID:1128

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gjgkqudn.cmdline"
2⤵
PID:1828

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDBD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDBC.tmp"
3⤵
PID:2240

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2hwkw7jm.cmdline"
2⤵
PID:2528

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE4A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE49.tmp"
3⤵
PID:204

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ssjvgfih.cmdline"
2⤵
PID:2872

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF34.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF33.tmp"
3⤵
PID:4056

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cydsnunm.cmdline"
2⤵
PID:2824

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFC1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFC0.tmp"
3⤵
PID:3584

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lshfqgzx.cmdline"
2⤵
PID:3708

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES10BB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC10BA.tmp"
3⤵
PID:1888

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ambntagp.cmdline"
2⤵
PID:2532

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1148.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1147.tmp"
3⤵
PID:3224

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\7y1loqxv.cmdline"
2⤵
PID:1864

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1242.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1241.tmp"
3⤵
PID:1276

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ox_src-m.cmdline"
2⤵
PID:2248

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES12ED.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC12DD.tmp"
3⤵
PID:4068

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bms7hjwa.cmdline"
2⤵
PID:2852

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES180E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC180D.tmp"
3⤵
PID:812

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ipbzwinb.cmdline"
2⤵
PID:3720

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES189B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC189A.tmp"
3⤵
PID:2680

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vlxaaqhe.cmdline"
2⤵
PID:2376

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES19A4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC19A3.tmp"
3⤵
PID:1124

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wypzyrx6.cmdline"
2⤵
PID:1128

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1A6F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1A5F.tmp"
3⤵
PID:2020

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3fitzrej.cmdline"
2⤵
PID:1640

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1E09.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1E08.tmp"
3⤵
PID:3440

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\onhqfvgd.cmdline"
2⤵
PID:972

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1E96.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1E95.tmp"
3⤵
PID:2176

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ff2lo3ot.cmdline"
2⤵
PID:3984

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1F9F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1F9E.tmp"
3⤵
PID:1948

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tw1nej_i.cmdline"
2⤵
PID:3828

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES201C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC201B.tmp"
3⤵
PID:2284

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5amd-yiz.cmdline"
2⤵
PID:1792

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2136.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2135.tmp"
3⤵
PID:1216

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\7jzqjy9w.cmdline"
2⤵
PID:900

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES21D2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC21D1.tmp"
3⤵
PID:3676

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ba0yrgi4.cmdline"
2⤵
PID:3812

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES22EB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC22DB.tmp"
3⤵
PID:2124

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zhgftai1.cmdline"
2⤵
PID:1580

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2378.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2377.tmp"
3⤵
PID:3404

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES1544.tmp
MD5
60603671f6e6a998d33bee8d36cd0c22

SHA1
f269bc94e8a227e28431c977f229a745e8d62002

SHA256
080f29b9990063d22b8efc78c639cb6d79cdaf7ca1418d1f2d7d33e4af355301

SHA512
904b71ec1166b337994b2db30c74b761d74a1cb999726f01c16151d6bfc4c3971ce901759a9e86f3eeecfe9320b6a0f6aad3634022cb5987b5ae42a99233a3ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES161F.tmp
MD5
0d502c4cc615e5a02c6628f006e9a59a

SHA1
99f94ae666194ab29f65ce4e6e0086bcbd615979

SHA256
7c51aadefb5e30a166c55e1c28914e5df2521b01be9f85de98df7dd239e11559

SHA512
ec2c1c571d8f109d6ee830d0376c0f040d46e7b011b5c2085ba3a12f5b8cf9c5cdaf431f46b107b27ae3732d8e899812a3549a8f6ff981f1b2e829aea1bb34dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2707.tmp
MD5
fbfc3c8b790d5c7578da970053b690c3

SHA1
4793b3ae9c6e2c19c742cefe6994aa67c9775665

SHA256
86ac1f9e4867b2fa36a5c5e447d993a17239de73a8f029846898832b39812e0d

SHA512
4a782a069e83405dc1eca5a06158d660c10d66caf3e86bc1b860a9c3b4c851553f4d273c923093f24f3b08433f430ab16430033a49f2908bb340c1942db1d535

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES27C2.tmp
MD5
831a327f2520fb0a6bc1ea40eb68e0c9

SHA1
d97fe1d2f3a5d61c845be0a753845f0094152710

SHA256
825652a82370b5d5cd616dd8bfd751ef3f84580f6a325e8e12fcd97d02949cd3

SHA512
8834b09e1ebe62e8360211605858a83168921cec034de5467cf6a15800991fd47d4ccc9eddb742b89c569121ffb7e91463a27c64eeea43a70816a5308f9d1168

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2B1E.tmp
MD5
fec1945c47f9ef7d3bd7f409b84dcd39

SHA1
987cf192ca99374473da22b1dc6c93a0367210ee

SHA256
2dbef0303b86bd40e20692e41243bd55b3691966028e2013ce03d2ca23f83403

SHA512
e675871d93c12d5d3da9e36f381e56864f1f77c6d11df359d16e6c5155de7a6105226414dd18292d1f6b6aed3b44fbc2866b09a1754f393ce94ccd5e249536cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2BD9.tmp
MD5
a64d239cb5ae6f1d57e84a79f02ecad3

SHA1
ce1bff028bc4c36e3def6a14d6ecb366c5d1a9a5

SHA256
eaf3192fc0c7afed18ac228ca13bdb60e4850c1f37943daba6b97b1cc6b00273

SHA512
f7df6ede9df72f5ee3d2391d61248685260573207c09e85d4bc5bcb2a228d1726db333f521d9ebc8c6353536489844f824bb1ebd8fdac3eed0feb30ef32623b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2CD3.tmp
MD5
2f4e4fabd5509e64171ffd902706b6f6

SHA1
4f472c8915aee341e053711032ef975dc195797f

SHA256
e4e58748aa641f34edfef9cec75dbcd081dcbcf6c2115776f3d54413c4a642ee

SHA512
163e458cde8d62e2c43c040692a1b6e36b0611d1dc923926c8a6f62b4f0f1431d9055ca1c5b29e0aaf3db637146de89341adcb30bb588eb77d42daa183228557

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2D8F.tmp
MD5
16333c2af9c8c003e3d5d7288b658d72

SHA1
db0d37fe69464f69ade4b0fee7d76b567daedc39

SHA256
a2a46fee5e9db12a0dd09d533d06f6ff2c2d06048e0550b3620f45d39784ea9e

SHA512
c19e7903ac05e7427c4de5eb4d65b1ce13fd0257fa9587869661bd6f9cdc762c65a6820a3376b5484b5ba066e18905db5a0360e6ca3ea85226579a15af21087f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2F35.tmp
MD5
c0bfde4a3fc03f1a5888a7eb40ef668b

SHA1
6b21c391e3f4874fb9b08b656d55d639bf2f77cb

SHA256
a437b913a954143ca2f9e7cf1bc25bae4e87b6aa3a5aeedef6259f31b2e943b4

SHA512
d4c509eb55bd7a3b3fdb54f31c724ee6f135130df08fc3c1e07810d70386df8a7019cf7ad79ba6a5bd10ea745fa630e322c28b5bea65ad39c3cdfedfee95ab88

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2FF0.tmp
MD5
ff5923141695d08cf1c763c1854dda93

SHA1
404962f643789df142290c6f490a4c293b7fa892

SHA256
bf45fbae0721ca1c9b800568d54ff7186a4f32159a908b0d261657b691d3f2c8

SHA512
6903080ec97231c4d3fc01ebdb7d37b51e464c1afd2a05cd77ca19768d5fa2d205f69c2b0b64d3103ae76e7d0ec4215eec37e5a7656f5670ce20128ecc3be974

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES30DA.tmp
MD5
4649540181e59d0e2a31ab9f8f0c3bf3

SHA1
4cf3a94dd623e56a266ad6b95979130212f4bdf9

SHA256
d368c796e6c068d027d4b2d24a089a8f21a4a280a6df5df832eac3ca36dd45f6

SHA512
3fc6816c519ed7a07189cb1684f09de23053789e5e7c404bc92825a2417912efad7ee2b52953ac3e90bd95fdc3bc6b52b0a83d37d7133a70c8db8a2a91391593

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3186.tmp
MD5
0318357965b26226d318de82c9e272a8

SHA1
04d6185f9d9cef2cd110cf2e7294c8f2fcebb9fb

SHA256
ce7b014318050064ba5a1cc14a21f61247cc1b24f2693ee1b352a35fa84b4a63

SHA512
acc05f6eacc1540a044b7d1850b1cbe658bc3569ec18674e846ed0fadbb30dfc05dfd6e976b9622bdd33c590ee4b0835e37609d424c3ed2f711ecf766a14fe10

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES32CE.tmp
MD5
ade7d142a324c1c2794eea8022350647

SHA1
0c8f6a100e031db6f4775c44e0b2722742c7a318

SHA256
acd2ba374ca9a09592db42e56f402fcc7d0e52379d911d5c103de78de3fc30e2

SHA512
e635e5926133f8b9788d9f02abc53d486ba0b1a793d045fbcba1e2c640a4de8624c566e88882e0675c7c04e55aad47cd42d34ba3e69c01b6574e89cc53d5dbaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\x1084y.exe
MD5
cb0c75df391a03a331a072b46239086a

SHA1
c412b6b0bed0b17a1bbd2fbb9c5501496b5a05ef

SHA256
449cc4901151e38d7bb1a5b7d8f44b7d315c6b8bb56745e453545e6b0e84a4d1

SHA512
65cd8990522e2cf92697cfc8c0706504a387c14bf783fd4c0b2bba4efbc2c42746254b236e1630b63d05bc3c0b222fd14789dd04067cf9d2a3622a8156dbfe57

Download Submit
C:\Users\Admin\AppData\Local\Temp\x1084y.exe
MD5
f825799fbf8ae82c435ff4fa81ece10b

SHA1
576902d1b6b18f57f2566cec2d1b5148354bd5b5

SHA256
4d06fda899ed46c4b97c5880ee50c13c84da704676fae0d00503d690da496747

SHA512
6dc396be028bc40a9c5e44b98d57ff269749f2b92a93aa4b6921da4dbd5eb14959b4fd7f58964001dc2d57a89fa1309354d3aefa6954e1c6354a6edfa7a566ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\x1437y.exe
MD5
c5be8dfcd29dd8c7a53b05d18517f67f

SHA1
ea464d81ce79239becb1b3a71fb9cf8cd4bb37fa

SHA256
9d657f697eb79a57e07fd277be5b1d31a6a1d6cc74d8a81160028c947a4f5840

SHA512
e1e6687e585d5b937d7c5008b7e93f3fbcaac6574461da198a1d008e12bc8457f95ecfd35d59cd9deb108aa4577345000d02d6d29d6f353c9061e79847498092

Download Submit
C:\Users\Admin\AppData\Local\Temp\x1437y.exe
MD5
a6e2a8f013b54d925bd19093a5d44668

SHA1
86252552763bb4e632e84628fc5c1a8a44e469ca

SHA256
b3143fdac1d131401f2d6c9ab523beb4b4e92dc7dbf4050981842b086e3a5f08

SHA512
cbeb6578d0a7a7c5e7ff1c67d740a3bbde11a6150f47ce63ed4f98c8797822f80726d9135d0d5a739e16d2ecc3e2875192026066729fce7a1d34f37196d67b0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\x1935y.exe
MD5
941f3778f88645cf839cf3d0f5146e88

SHA1
d0ab6483ab287da06214cba176da413133f9e885

SHA256
091bcda92181cd2da2aa397e2d48ac8d117215c11182e7a7e406739320f156bf

SHA512
8584e80e5547b0d667e18b1ee72acc7b10ec646eefd82adc7cf9764ff8466f4e30377729910fa5177370e2de27097ab9d92fde4fe683d64c38c7e1594a1e005d

Download Submit
C:\Users\Admin\AppData\Local\Temp\x1935y.exe
MD5
14958e297659230f69bd741b284b6976

SHA1
5db064fa1e780799666f37e57a7a27ea6014cfcd

SHA256
125b03b98b6d258cf9b0857955c7769798a0c9e9825bfd7ee6025e1b2706e696

SHA512
a1a9ff7cb35481bdb849b9fa69c3b2ba3e5b8f0a317e57cf5b1cc0d5d6b71ea474ad26ea219e6fef3b7e1f72afb14dcf79af43d8eeba5537a48d174041311c6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\x360y.exe
MD5
a6a9aab1f37d0c45c80a35d07eb5a7e3

SHA1
63f23feb4eeed53f9036b2b6df9896b58cc646fb

SHA256
581dd8972fee02c242b9d0fb6f0f644470ce94e4a8613472b2605e8522d96c42

SHA512
ef4ce83e868cda5e4eef94bdcb132b7c5c2a53f790ba386c165c88ac26f70ee9358ab72bccc12006ee020efced11ee66db8b4c325564bc6c1b885dda020af4d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\x360y.exe
MD5
dd332cb94f28e146b83a39417f2d6507

SHA1
856fd249f61e670e667e7442aa1ab20077c8b3a9

SHA256
d77a7850c58ed2ffb9f63a69df79df5b3293f359a041f0e4a549ff59e0c7e124

SHA512
e3f8ab29f34d1b6e8490b41530d39aba58ae9dabce11c5fa3d50dcd285256b67cbc896d5817a782ec8cbc0bc9cdfc8994a630d2776a596aa73eb5579d28fc72e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x493y.exe
MD5
1109421b63f7527d83bd212bedde9df4

SHA1
5d7808f04a58c140840f095d1d2930321f75ef32

SHA256
f4831e7e9956e537108e1b841e477e531d5d8b04eebf8a561672e17e8d89e387

SHA512
d5eaad853bfc5e2d9d7845e021680a97084cafaf853650dd42f5543ae6396bb222b27ff1d8cc66c46efef4f41607d098689181b73db28124293db3ad8faaa41c

Download Submit
C:\Users\Admin\AppData\Local\Temp\x493y.exe
MD5
cd5c3963ecd0831ae2e028827ebf0c3b

SHA1
6aaab825282efd75f9e4f5102120a9e75acec5f3

SHA256
9bfa128bf3f9ac56a7c7ebbe4c0a126a2981d0d8aa1d543ac5a5d1ea88a22690

SHA512
f54a2aafddf9045d10c1a3e0a3a63ab5714f0fea96d68c9c34804bce804893c99373b34c1be6b150dc56db809b0996f4f3a866e4ffe5b744edd57d34e236b6ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\x786y.exe
MD5
e3fa28490e410a3c7cf1e642959ae8fd

SHA1
c02495018c0e721ef410ce1024e405aa2b3f73c4

SHA256
4412e81d3788fa8c2ce71e2653c760d1f85c188ebb68663d068d242443002ec1

SHA512
8c7770d07566b5fedf11591d4206c09925290147b4930b25dfd690b398ae831d4ab48872d13dca3808b3f2eccacfc25b1fb45fedca2eb5695322c6ab69e55854

Download Submit
C:\Users\Admin\AppData\Local\Temp\x786y.exe
MD5
51e7404eb82c835bf31267fcb1170009

SHA1
b229d887916791e27b59314a19da36a7d9b8874e

SHA256
863ba93ec9658066c016da28d15ea8d968cfe42f90a471f1cabc880820dca73b

SHA512
4cf3f826a15e08ea62bc1345a89787c7977915bc1c5b643e994c5b97e3c08fcf3a8b937ba2a0ce6edb7ef6f98ff1e40e26a67599049c86095009c840b8d78567

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\-hbwsegx.0.cs
MD5
0aaf97d34b9d46d78273354f07b5da4d

SHA1
ae4648d8c4201a1499c8b3a68fedf0e7b90cdf7b

SHA256
8c96e5ce2cf3a405904e4dff48a5140d0ecc7d7e8b5871dd2743a4cb28f81de0

SHA512
9156c8e18ab567dcd6325c062119bf8d7051558d9398c9c9ef103053ab0b5effed75ee538f6081605c849ea43c329f6b3c6977a3894bf982105b3e960b71ea60

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\-hbwsegx.cmdline
MD5
8c481897432e11b2dfabac221017e5c7

SHA1
228b43031577d45b28ef4edea107ddc5f76be842

SHA256
e6a821cfa370e082db3c5b5cad76e4ab49d7ef58e9c6e3191aebcd9e8a3b9985

SHA512
ec29da369a07612b788978d5db5c2207494d8a2ca2ade063884235e21246dd4e49a502a90c32478248787bc6dc8b49ad89e281bda480a0304807002f00047fdd

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4f7ga6of.0.cs
MD5
bacefe64fdcd49e27e7b0143b47673a8

SHA1
60da02861754813fa1cc47712cfa7c7fc0364530

SHA256
d39c4f83de4f21e5cfb77d9e3e152e4942b765f03d51faff67569a7a06cfff21

SHA512
7cee4ced8d1959970a60544419830a9a0087fd9dcea0ac7e463cc070ed2fda93bf48dac05695d5ee1e764caa313ddd3e170f0402f9e8c345de71128bdddfdc0c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4f7ga6of.cmdline
MD5
509c102f20fea2957ed141c00556e474

SHA1
c1247408e31caaeeb388ed6d28cf52b1a4131da9

SHA256
8f3f44398a5b94afc951ed8209aa96ed83500b4540a020af6eb828588c200c06

SHA512
0b806931b0a1cde18f9d860457fec4e53252c84fbe899ff359bbd3429f967c5715f9867a43eed3a7234045109397cf090682a56c1800be4537c7f35e68622e2b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\6iecw7h7.0.cs
MD5
aad2ad776622f0517bee2b62db30e638

SHA1
f3aeef5c55afca49c74e2f363161f5b63d9a4913

SHA256
683d3a0d86e9c29b3eb22c4ef34c5b31be2711ff272dad953b29bd554b1a3e6c

SHA512
04def9692c185e86553f8ff624077409b68c546a601d37523585c135243e4b0cb507b804d33ca4027d56fd52b95a0bf82b3fb36ca1b3a663a13d63ff813d71f7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\6iecw7h7.cmdline
MD5
6ad3b7cd961a4414081806bbcf7772bf

SHA1
4fb9b1af4ae5f75d1b99c967b1acd727d6c5df42

SHA256
d37d0b31024195b15ab61021a902452131fa5b7fb546392c2c56eef5953f7276

SHA512
0d27654630e050b203c1e2119ee7c2c094748589163774b1a66db982973261752732d24872939e82d5bb54d6bb24b9f486d0c0eadeb6be09eda0e00afd2afa2b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC1543.tmp
MD5
3f88d75269e46205cb5e69c0a1a0e8af

SHA1
c57a1ef5e1b5f6e9b6ca9acd0bc6916b5182a02a

SHA256
084db825869271d562f60eea03e1db9abfd9ab758254319073a5eb1ce849e25e

SHA512
4dbfdf5d1dcddb50290c6b0d2eca9928dc98ba3e5bd47f465295e1db429ddf4aa814ab8f11e7ad49b56cfd38c50d85a60bee234cbbea62da1c47fcd09fbd380d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC160E.tmp
MD5
3f88d75269e46205cb5e69c0a1a0e8af

SHA1
c57a1ef5e1b5f6e9b6ca9acd0bc6916b5182a02a

SHA256
084db825869271d562f60eea03e1db9abfd9ab758254319073a5eb1ce849e25e

SHA512
4dbfdf5d1dcddb50290c6b0d2eca9928dc98ba3e5bd47f465295e1db429ddf4aa814ab8f11e7ad49b56cfd38c50d85a60bee234cbbea62da1c47fcd09fbd380d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC2706.tmp
MD5
684b52e52c72fd69883cd8a977132df6

SHA1
eeb7f03a3c73466fc4cf709d252f3d17a4de9bf0

SHA256
2bc4f57fb7464598b1b92d420e004ceac6100194619f42cf3c9c7f7c77fdf2e9

SHA512
3a542a1fac4202a5e08ff602c5e602c0215b5e12ef9ad066919f35cfdb083ec01fcb542ad67c52895ba5d081e7938394e674e4bbd45084dab9c9f04960b04860

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC27C1.tmp
MD5
684b52e52c72fd69883cd8a977132df6

SHA1
eeb7f03a3c73466fc4cf709d252f3d17a4de9bf0

SHA256
2bc4f57fb7464598b1b92d420e004ceac6100194619f42cf3c9c7f7c77fdf2e9

SHA512
3a542a1fac4202a5e08ff602c5e602c0215b5e12ef9ad066919f35cfdb083ec01fcb542ad67c52895ba5d081e7938394e674e4bbd45084dab9c9f04960b04860

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC2B1D.tmp
MD5
067e708541f61a37fae95ace0394e6e5

SHA1
3d087c0bd3f0dc09d54981ac463a25a30f79003e

SHA256
f6f57224ecab09d6679a7496ea848bd6b20269c4e693329ce785a1a23ad15e7e

SHA512
d463d416fc1e949d85445febe688fdfb70111761c9930646131a1ae3c1236471f3030180cefe24b9056e7be2e15b33f588bda27eb53f3757ad303cb82511c912

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC2BD8.tmp
MD5
067e708541f61a37fae95ace0394e6e5

SHA1
3d087c0bd3f0dc09d54981ac463a25a30f79003e

SHA256
f6f57224ecab09d6679a7496ea848bd6b20269c4e693329ce785a1a23ad15e7e

SHA512
d463d416fc1e949d85445febe688fdfb70111761c9930646131a1ae3c1236471f3030180cefe24b9056e7be2e15b33f588bda27eb53f3757ad303cb82511c912

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC2CD2.tmp
MD5
3513c7931efd1ce26ffcb501cbb1f3c1

SHA1
17422bc6782ed0520d7eb363dcca074ef37ecb95

SHA256
5cfcb859b2981f10b4c1a82f6bd1d3c7acf0a388102ac0c665211e643591f09f

SHA512
73563bd157ae7a7894290a59860c3e9aebe1cc60b0396e646346435f15301fa962801f05b0d160e5ccd693bad363bf556dc366726f3787a96fc0ead16b3c4f81

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC2D8E.tmp
MD5
3513c7931efd1ce26ffcb501cbb1f3c1

SHA1
17422bc6782ed0520d7eb363dcca074ef37ecb95

SHA256
5cfcb859b2981f10b4c1a82f6bd1d3c7acf0a388102ac0c665211e643591f09f

SHA512
73563bd157ae7a7894290a59860c3e9aebe1cc60b0396e646346435f15301fa962801f05b0d160e5ccd693bad363bf556dc366726f3787a96fc0ead16b3c4f81

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC2F34.tmp
MD5
58cfdaad199816675b3e54c4248b6cb8

SHA1
2ce918101b524503c63948828fc5493a92ab6e07

SHA256
320fb78160615f7c2b6eb2a440ad8f09783a36daa8aedfcba624244b12751846

SHA512
b2ffe090d7c5259a8581316fb1f4e0a30eb77db9a32e8676e6b8d4bcf978103e571a724502af5c2d7b9719c5b3c9ba1e719994bec78d2e192ef06b2d91c4543c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC2FEF.tmp
MD5
58cfdaad199816675b3e54c4248b6cb8

SHA1
2ce918101b524503c63948828fc5493a92ab6e07

SHA256
320fb78160615f7c2b6eb2a440ad8f09783a36daa8aedfcba624244b12751846

SHA512
b2ffe090d7c5259a8581316fb1f4e0a30eb77db9a32e8676e6b8d4bcf978103e571a724502af5c2d7b9719c5b3c9ba1e719994bec78d2e192ef06b2d91c4543c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC30CA.tmp
MD5
f28f53d24a4ed7184c0b1954184c36e3

SHA1
eccad0a000b3f74177105ac2289f36ee5b8b0b46

SHA256
dd59293586b41b5cd9b96648dc6ac5d7197602de9b7aac7f700741bf0cef0487

SHA512
4c05b80f3f34fd6790a3ec0c3acd0391f9433ed96149c5fba42eae2f418e552bb9ab15cb71e6c8ee2ad93b1e0b2b767707a534ebe05fa3202a2a483beb954803

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC3185.tmp
MD5
f28f53d24a4ed7184c0b1954184c36e3

SHA1
eccad0a000b3f74177105ac2289f36ee5b8b0b46

SHA256
dd59293586b41b5cd9b96648dc6ac5d7197602de9b7aac7f700741bf0cef0487

SHA512
4c05b80f3f34fd6790a3ec0c3acd0391f9433ed96149c5fba42eae2f418e552bb9ab15cb71e6c8ee2ad93b1e0b2b767707a534ebe05fa3202a2a483beb954803

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC32CD.tmp
MD5
0aca37af7a2aa98f6966826276102764

SHA1
738a270a86d4be2af81846bcbc85082fea7bf61c

SHA256
efed33a183d2c9053d16242fa743a16a0f749941f59a0cd209eb45d92c99898a

SHA512
8f975d70c4b8e0aa6844ca337d950eb67c9043c903ce07a866cb0d08f1a253c89b892055d3cb711bdde392cfeeacb14456178b5988e90f5e4e27f9fd96037875

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\_sw3i-ua.0.cs
MD5
b77a2263ad737afdcf0e3c64bbc8217d

SHA1
fa26585ac9e35072c00b5f0ba3eec390a09a4cc2

SHA256
44ff7a3d514b8d8936c607c04362d403e02c6e3549f0e342c345fb3bf4c24e18

SHA512
a83e46ce9711e53c3052bc6337b46297f57d1eb9ed6cb58348c2a02ac5fa6897babac3d63e1d0313b74e32e98413f34671b3816bc9f148dad0eca55c5af6f827

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\_sw3i-ua.cmdline
MD5
8c413f754ddd7f98aef987f0b11a45d3

SHA1
b870f1dd459b9a4c8859f43011f58743c00fccab

SHA256
51fe811616d0e58b22cb1feca6b7ae37534cbf5d8de4651d9dcba2d52b937294

SHA512
043405efe8c5b1756a9620613aa120c446b77bb78c9408176f3959a5c5eb8fff8daf40fa18049b51cd268575d251d48abe3f0098ea08720e2d4ed37b3c077d53

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ar8pejyd.0.cs
MD5
e23d461113e550a882536cbd7352a220

SHA1
ca13f517785368149df5a27ace4c77c3067e6a6a

SHA256
5a1ce490f95f7edfbbf22740fabc7957e3351f56fe4f1b75af794e5e97a5544c

SHA512
128ff3d44e38985392ced9d6bfa400b8c6cf3b6b3fea6ad71f3bb8f2682b9ab37f786f2848e5ed76d7e0b703a192c6aa6ab9b39d1c7e066096ddb3d037c7b505

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ar8pejyd.cmdline
MD5
b152652952574ecaa6cd36a7ad8af93f

SHA1
d9582eeacd5190fdaaef0df737d4d83eb30e43aa

SHA256
6216d24247a9cf9381bcfa46df3a89671f0e68ccd741691fed5fffc276ea274e

SHA512
2c8a7335f5e603794220a00ced3e95a3aeda54946a8d6648246e786aeb69412ca8c9e9cdb60b46852afdc79379ff70e47c418a49a9fe68e120ba444c3a1604aa

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\df-bdaym.0.cs
MD5
962c015828e1fd97d51a0e7c23cbacc0

SHA1
c433fe5f6cdeef5b8d200fbf99d19882a687d437

SHA256
ec99c051c3c7cf5849ba5ed0e882af7ac2dc3ab7df1d98f41216e862b27cc09b

SHA512
48cfae8aa271e14ba883fcdfea0925d7a74a855664524688f7064f41587ffe5bc9973c5a2d344113192776486d86f01d8ae64aaf02114849377bdd8e3566258b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\df-bdaym.cmdline
MD5
029bfcc7a387f7878c488feb023b8b3b

SHA1
5dca991139dd4f5730975034887339d7a987ae31

SHA256
5b92e7d0678b7a9827ee83b4fc57344c70996c8693d4e59e6e0c42cb5168a28d

SHA512
5da9a83f7424f08bc31fceac79e94684409d419f936f44486afa8be1deb565110c0475046cbf68061eca5c7d2855c0821dff2f6bf523385b67df33bde497acb6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ehktacza.0.cs
MD5
1fff656202b70315d2801775e23d1e74

SHA1
ceb45c9383b45cd468aaa4a0b6b3fa2c0ef27ad1

SHA256
9d897c7bde34268193fcf583a2a254cdbdf441405ea21a8de31f8f872888437c

SHA512
7b5a9a80594d705094e8093e86206ce68d9e8c5ff9398b29b68ff61add158af5436a0ed327f2f072f06edc7fdf369bc7c968ebb8180532982be3b43008304132

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ehktacza.cmdline
MD5
14edb9d7523cb4dac59a1fa5b1ba8fdb

SHA1
dc1c0cf31d685939191054d5185061b5b2f435e7

SHA256
dde074ab2a8fa8fdcc27b7c46df21f36d89c696b84f1cb5eedfb8aa69d0af642

SHA512
83b7ab34f31fbd94ae78f78a079ae50d3034ae2d79277c0af2760bd98bbeb1f9b7465b992f461345f8ef61369a4e25df3ea0e08af6e16240352868a39b13c837

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ey8pnceg.0.cs
MD5
c94c8b437bf2f589f584623a28cd1e3e

SHA1
6edb3a80c1e43c6d8dd2c2cca3c1d84a0ebcb22d

SHA256
25948baa43bf6940b1df804783d24752db3e6edbd75891a1bb8b3e8dd633f12b

SHA512
abacddc4e5f68f291b7773c3d37c4b81b15a2781c29b3a31792641c7ca0b48a32c405803a8e70f38c85c5b8217686e272dfe3d4a7daf980137eefcd6afc936d5

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ey8pnceg.cmdline
MD5
105edc820296863ca7852723c5b93c5a

SHA1
6ad8b4677971c3e697c8ad3393b35e06970d0214

SHA256
e32a038909e3fb0e945562a4eb0b3c9445af2f2489f96d6ada22bc0976dc59e6

SHA512
de7d96d7e9721c37552e620c2e83004b0f5b05afec4d71ecf80822ec454646ce8885a9acaff84e162dd0e96f894be194de7f62bd9a7b4f9005af5416c7f7d8a1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\gvqenhts.0.cs
MD5
a066ad785eda3f244e74e068395a909b

SHA1
f85cb6137e997779a498fa9f579dc5a037e78666

SHA256
d8f41c528c57979f09ba2a48664c566ee0228534e95e3fd4cfd4369ec4a79424

SHA512
258969955152958ef703ffcd3fd987da03dba1f151d572127f131aea213c004e529020681d47529e798dc1c2864fda1ca9381637da1e131350f478221680e251

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\gvqenhts.cmdline
MD5
b11329b7a8af7158898fb620a1a7be22

SHA1
9114ff9d2f236c1335777162e6b5aac9943a939f

SHA256
ba482c3df5a3e2352b646858a61d3e30034cd1d66c1a220b335d135a73d7c664

SHA512
1042420e8f90691b6c83dcabdc2c021268dde00ee0b6198c1cccc92e0f8be1d4492be45dc42f8f8259514a9bba583c1437620d806f624a0feee23feecc3c1e79

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kpc3yrwk.0.cs
MD5
db5b8da980bb9d7759aa9d58e3a6cd84

SHA1
cc2828c81abcb73e8865df07b5c7653ed99eb13e

SHA256
e29191dbeeb422276c5498e2f6fbf76283452ae13fc0ad82e0b47bef74a20d73

SHA512
2532689492211dc53f7a1c247d4b911ad49534fa8c48db615ae906e7bfb2d8db497d395b261cb353fceae48e57a52c8362cbe197ecf4fbe711e094f0845d5a2c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kpc3yrwk.cmdline
MD5
bf1d15efe9ba7dd2fa885ba4dd5b975f

SHA1
8c4f8f2bb3ac17e3b78bef99b87db8dd16a32b9b

SHA256
9298bd3d47aede6938a91a094eea4abf76bb0a9e17d3e9a75ca51d40d0c60340

SHA512
06b424a9155dd6a67e43464e91bcc28fc7be0962850e6b88b32a2b40fcea2904e6e7065e762c5e5f8ddbc4551a3778e750866121013d4db1bbe622b836bb3d1b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\luvx5leu.0.cs
MD5
ce34a67dd27fc22d1728dcb03d48a1e5

SHA1
a226a478c0c94241b31a3ce346088660726cdc91

SHA256
dd4ede5a9c9cb8468d5a6200ba8e89c3e2fc4182478f168d56af9dc7246e0e4a

SHA512
cbc0d273448db23a18a4c56bfd05a924b554140d14b718c244d649564093aae9ae00baea2f5af5e392b4e41ad5ae3149b894e202790395626eae2ae668351e0a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\luvx5leu.cmdline
MD5
3203669bc4221c34a2a2da3178ae0a5f

SHA1
2093944f8c074f8ba50a2427374544eb596c21c4

SHA256
bcf2dd4ab4dc97a80631cec23a2e1a11082b66aca6470eb26fa5e44125aa0b4a

SHA512
245f21aa4923ae18815bb5a8639e8412368929ad0b9e348db820c90385c2c39e0f14ed93dfd61bbccf41bdd7b54a82a8f30e479ffb3414ff05607d636acf58d0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ss-0d-qi.0.cs
MD5
a7b765de6c896473f33b4b75c62f4d4b

SHA1
7295907d9d97af6a57709c77f2ebceda5259f364

SHA256
2fdf257383c3b9dcfefa4c37363c5423160fb744aa6c1fecef1378e586f2055a

SHA512
3bf948282724630497f3991b237a41b2837e7556534681abc561ba58156b047a2db6aaeef3f35f1828d85099d0c9fd1cb3f7614b28f4e623bfa042c0c3ad47b6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ss-0d-qi.cmdline
MD5
317b5610c310b6cca0be1e23c1905771

SHA1
326673655947d2efb3e84065bb1170e92250b2a1

SHA256
ee39c3ae5e2be73b3a4e75ce90181ac78e702a954f5f81d08d5c5dde6f1c8a5f

SHA512
33101e633b1b8f83b1d95b4c775bcf5cd21c9ae0f221bf84be8612bea482c1598517ea4e8f901c8f74add9d002ea55430b1d8f1913a8a8c1b162ecaca2f0bf07

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\u3gcdaja.0.cs
MD5
85ea432ce87efed37a6d160b36794267

SHA1
bb0686eb5c7c34a5a0bcd4f6e3f661e29e3e75cc

SHA256
a5c96f6ac1aa35365b1a1895b2f87a872ffa6c4d79d1c4651bafc987d7b3d316

SHA512
cfe1a8751c92094e723a5fb4b5ff54c023f2cc3b326cbef3d97c9a237bd925ddf8d85d0420340fa5a35269cc300b58e4bdcecccf3e3113ea00da946ac5cac706

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\u3gcdaja.cmdline
MD5
542ef82cf4e914eeea2b8875ce19f490

SHA1
751e72a5f3847f04e00ccb5469668bdbf853c2f9

SHA256
6519d1ce2afe92fc2922ecd813172df65130dc2d6092c7aaf32ac359f66d8ae9

SHA512
4d48c92a6c37aea4c51a330a1affbd5d58c32a43e72995ccb73958e82637eca9732b07d78d7b1224c64bd60ad48994583a85d65ea57c9a0d1c3b7ec1dc87cb6e

Download Submit
memory/204-243-0x0000000000880000-0x0000000000882000-memory.dmp

Filesize
8KB

Download
memory/204-141-0x0000000000000000-mapping.dmp

Download
memory/204-237-0x0000000000000000-mapping.dmp

Download
memory/212-223-0x0000000000000000-mapping.dmp

Download
memory/212-203-0x0000000000000000-mapping.dmp

Download
memory/212-302-0x0000000000870000-0x0000000000872000-memory.dmp

Filesize
8KB

Download
memory/812-265-0x0000000000000000-mapping.dmp

Download
memory/812-240-0x0000000002340000-0x0000000002342000-memory.dmp

Filesize
8KB

Download
memory/812-233-0x0000000000000000-mapping.dmp

Download
memory/972-178-0x0000000002190000-0x0000000002192000-memory.dmp

Filesize
8KB

Download
memory/972-269-0x0000000000000000-mapping.dmp

Download
memory/972-161-0x0000000000000000-mapping.dmp

Download
memory/992-305-0x0000000000880000-0x0000000000882000-memory.dmp

Filesize
8KB

Download
memory/992-236-0x0000000000000000-mapping.dmp

Download
memory/992-164-0x0000000000000000-mapping.dmp

Download
memory/1116-145-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/1116-131-0x0000000000000000-mapping.dmp

Download
memory/1124-294-0x0000000000550000-0x0000000000552000-memory.dmp

Filesize
8KB

Download
memory/1128-254-0x0000000000000000-mapping.dmp

Download
memory/1140-270-0x00000000008A0000-0x00000000008A2000-memory.dmp

Filesize
8KB

Download
memory/1140-255-0x0000000000000000-mapping.dmp

Download
memory/1140-276-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/1204-281-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/1208-303-0x0000000000460000-0x0000000000462000-memory.dmp

Filesize
8KB

Download
memory/1216-256-0x00000000023C0000-0x00000000023C2000-memory.dmp

Filesize
8KB

Download
memory/1216-231-0x0000000000000000-mapping.dmp

Download
memory/1216-245-0x0000000000000000-mapping.dmp

Download
memory/1264-291-0x0000000002340000-0x0000000002342000-memory.dmp

Filesize
8KB

Download
memory/1440-296-0x0000000000990000-0x0000000000992000-memory.dmp

Filesize
8KB

Download
memory/1676-273-0x0000000002350000-0x0000000002352000-memory.dmp

Filesize
8KB

Download
memory/1676-264-0x0000000000000000-mapping.dmp

Download
memory/1792-274-0x0000000000970000-0x0000000000972000-memory.dmp

Filesize
8KB

Download
memory/1792-266-0x0000000000000000-mapping.dmp

Download
memory/1804-129-0x0000000000930000-0x0000000000932000-memory.dmp

Filesize
8KB

Download
memory/1804-115-0x0000000000000000-mapping.dmp

Download
memory/1828-262-0x0000000000000000-mapping.dmp

Download
memory/1828-271-0x00000000021B0000-0x00000000021B2000-memory.dmp

Filesize
8KB

Download
memory/1828-171-0x0000000000000000-mapping.dmp

Download
memory/1848-246-0x0000000000000000-mapping.dmp

Download
memory/1848-277-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/1864-219-0x0000000000000000-mapping.dmp

Download
memory/1888-293-0x0000000002240000-0x0000000002242000-memory.dmp

Filesize
8KB

Download
memory/1996-238-0x0000000000000000-mapping.dmp

Download
memory/1996-300-0x0000000000850000-0x0000000000852000-memory.dmp

Filesize
8KB

Download
memory/2072-221-0x0000000000000000-mapping.dmp

Download
memory/2076-209-0x0000000002230000-0x0000000002232000-memory.dmp

Filesize
8KB

Download
memory/2076-186-0x0000000000000000-mapping.dmp

Download
memory/2076-150-0x0000000000000000-mapping.dmp

Download
memory/2076-250-0x0000000000000000-mapping.dmp

Download
memory/2124-287-0x0000000000820000-0x0000000000822000-memory.dmp

Filesize
8KB

Download
memory/2124-241-0x0000000000000000-mapping.dmp

Download
memory/2128-134-0x0000000000000000-mapping.dmp

Download
memory/2148-268-0x0000000000000000-mapping.dmp

Download
memory/2148-275-0x00000000022B0000-0x00000000022B2000-memory.dmp

Filesize
8KB

Download
memory/2148-147-0x0000000000000000-mapping.dmp

Download
memory/2148-176-0x00000000008F0000-0x00000000008F2000-memory.dmp

Filesize
8KB

Download
memory/2148-299-0x0000000002350000-0x0000000002352000-memory.dmp

Filesize
8KB

Download
memory/2152-225-0x0000000000000000-mapping.dmp

Download
memory/2192-213-0x0000000002400000-0x0000000002402000-memory.dmp

Filesize
8KB

Download
memory/2192-207-0x0000000000000000-mapping.dmp

Download
memory/2196-298-0x00000000021A0000-0x00000000021A2000-memory.dmp

Filesize
8KB

Download
memory/2196-235-0x0000000000000000-mapping.dmp

Download
memory/2196-242-0x0000000000530000-0x0000000000532000-memory.dmp

Filesize
8KB

Download
memory/2208-286-0x00000000008A0000-0x00000000008A2000-memory.dmp

Filesize
8KB

Download
memory/2264-212-0x0000000000000000-mapping.dmp

Download
memory/2264-232-0x0000000000AF0000-0x0000000000AF2000-memory.dmp

Filesize
8KB

Download
memory/2264-230-0x0000000000000000-mapping.dmp

Download
memory/2268-289-0x00000000008A0000-0x00000000008A2000-memory.dmp

Filesize
8KB

Download
memory/2268-267-0x0000000000000000-mapping.dmp

Download
memory/2272-288-0x00000000022E0000-0x00000000022E2000-memory.dmp

Filesize
8KB

Download
memory/2344-278-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download
memory/2484-118-0x0000000000000000-mapping.dmp

Download
memory/2484-239-0x0000000000000000-mapping.dmp

Download
memory/2484-244-0x00000000022A0000-0x00000000022A2000-memory.dmp

Filesize
8KB

Download
memory/2488-283-0x00000000023C0000-0x00000000023C2000-memory.dmp

Filesize
8KB

Download
memory/2528-182-0x0000000000000000-mapping.dmp

Download
memory/2792-279-0x00000000008E0000-0x00000000008E2000-memory.dmp

Filesize
8KB

Download
memory/2792-227-0x0000000002450000-0x0000000002452000-memory.dmp

Filesize
8KB

Download
memory/2792-220-0x0000000000000000-mapping.dmp

Download
memory/2812-122-0x0000000000000000-mapping.dmp

Download
memory/2812-130-0x0000000000BD0000-0x0000000000BD2000-memory.dmp

Filesize
8KB

Download
memory/2812-157-0x0000000000000000-mapping.dmp

Download
memory/2852-234-0x0000000000000000-mapping.dmp

Download
memory/2876-284-0x00000000008E0000-0x00000000008E2000-memory.dmp

Filesize
8KB

Download
memory/3120-251-0x0000000000000000-mapping.dmp

Download
memory/3120-295-0x00000000022F0000-0x00000000022F2000-memory.dmp

Filesize
8KB

Download
memory/3120-259-0x00000000005B0000-0x00000000005B2000-memory.dmp

Filesize
8KB

Download
memory/3176-114-0x00000000007F0000-0x00000000007F2000-memory.dmp

Filesize
8KB

Download
memory/3224-304-0x00000000008A0000-0x00000000008A2000-memory.dmp

Filesize
8KB

Download
memory/3224-248-0x0000000000000000-mapping.dmp

Download
memory/3224-175-0x0000000000000000-mapping.dmp

Download
memory/3224-208-0x00000000022E0000-0x00000000022E2000-memory.dmp

Filesize
8KB

Download
memory/3384-222-0x0000000000000000-mapping.dmp

Download
memory/3384-285-0x0000000002290000-0x0000000002292000-memory.dmp

Filesize
8KB

Download
memory/3384-228-0x0000000000930000-0x0000000000932000-memory.dmp

Filesize
8KB

Download
memory/3404-215-0x00000000009A0000-0x00000000009A2000-memory.dmp

Filesize
8KB

Download
memory/3404-200-0x0000000000000000-mapping.dmp

Download
memory/3464-290-0x0000000002370000-0x0000000002372000-memory.dmp

Filesize
8KB

Download
memory/3508-177-0x0000000002340000-0x0000000002342000-memory.dmp

Filesize
8KB

Download
memory/3508-154-0x0000000000000000-mapping.dmp

Download
memory/3508-292-0x0000000002170000-0x0000000002172000-memory.dmp

Filesize
8KB

Download
memory/3508-272-0x00000000023D0000-0x00000000023D2000-memory.dmp

Filesize
8KB

Download
memory/3612-214-0x00000000021B0000-0x00000000021B2000-memory.dmp

Filesize
8KB

Download
memory/3612-193-0x0000000000000000-mapping.dmp

Download
memory/3720-196-0x0000000000000000-mapping.dmp

Download
memory/3724-253-0x0000000000000000-mapping.dmp

Download
memory/3724-260-0x00000000008F0000-0x00000000008F2000-memory.dmp

Filesize
8KB

Download
memory/3772-297-0x0000000002420000-0x0000000002422000-memory.dmp

Filesize
8KB

Download
memory/3788-125-0x0000000000000000-mapping.dmp

Download
memory/3788-252-0x0000000000000000-mapping.dmp

Download
memory/3792-280-0x0000000002300000-0x0000000002302000-memory.dmp

Filesize
8KB

Download
memory/3880-257-0x00000000024A0000-0x00000000024A2000-memory.dmp

Filesize
8KB

Download
memory/3880-247-0x0000000000000000-mapping.dmp

Download
memory/3896-138-0x0000000000000000-mapping.dmp

Download
memory/3896-146-0x0000000000940000-0x0000000000942000-memory.dmp

Filesize
8KB

Download
memory/3900-301-0x0000000002200000-0x0000000002202000-memory.dmp

Filesize
8KB

Download
memory/3928-261-0x0000000000000000-mapping.dmp

Download
memory/3960-168-0x0000000000000000-mapping.dmp

Download
memory/3960-179-0x0000000000860000-0x0000000000862000-memory.dmp

Filesize
8KB

Download
memory/3968-258-0x0000000002240000-0x0000000002242000-memory.dmp

Filesize
8KB

Download
memory/3968-249-0x0000000000000000-mapping.dmp

Download
memory/3976-282-0x0000000000880000-0x0000000000882000-memory.dmp

Filesize
8KB

Download
memory/3976-189-0x0000000000000000-mapping.dmp

Download
memory/3976-263-0x0000000000000000-mapping.dmp

Download
memory/3988-224-0x0000000000000000-mapping.dmp

Download
memory/3988-229-0x00000000023C0000-0x00000000023C2000-memory.dmp

Filesize
8KB

Download
memory/4012-218-0x0000000000000000-mapping.dmp

Download
memory/4012-226-0x0000000002380000-0x0000000002382000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads