df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3

Analysis

max time kernel
150s
max time network
140s
platform
windows10_x64
resource
win10v20210408
submitted
13-05-2021 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
Size

416KB
MD5

b7f1ff3fb7734885914d33dae1a728be
SHA1

2d6a851fc6280a163d3d38ba364b4118f565758d
SHA256

df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3
SHA512

d824c798a369d833b73b7dd72252cb87de73aba39196b2d881be34e0b79a50cd5a3acd4e19ab2d48c3f1241bdd8545a890c0a2894abe59558d08262ce0649273

Score

7^/10

spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 2 IoCs

Processes:

df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe

description	ioc	process
File opened for modification	C:\Windows\System32\TsWpfWrp.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\SysWOW64\TsWpfWrp.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe

Drops file in Program Files directory 1 IoCs

Processes:

df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe

Drops file in Windows directory 64 IoCs

Processes:

df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx35linq-addinprocess_31bf3856ad364e35_10.0.15063.0_none_41ab04018589ba56\AddInProcess.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\amd64_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.15063.0_none_357318c4046e3d36\TsWpfWrp.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\x86_installutil_b03f5f7f11d50a3a_10.0.15063.0_none_34c82b94bd86254b\InstallUtil.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.15063.0_none_c17d729c441d6e56\aspnet_regsql.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regbrowsers.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\msil_addinprocess_b77a5c561934e089_10.0.15063.0_none_ac938d72130f980b\AddInProcess.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.15063.0_none_c2c00e8330a5adbb\PresentationFontCache.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\amd64_wcf-wsatconfig_b03f5f7f11d50a3a_10.0.15063.0_none_bcc29c4403c6219c\WsatConfig.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx-jsc_b03f5f7f11d50a3a_10.0.15063.0_none_f9b02daf974f6d24\jsc.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_10.0.15063.0_none_37cf9bf85378124e\ComSvcConfig.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\msil_edmgen_b77a5c561934e089_10.0.15063.0_none_80cd4dc1343c6644\EdmGen.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\amd64_installutil_b03f5f7f11d50a3a_10.0.15063.0_none_ed1af4bda909fc45\InstallUtil.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx35linq-addinutil_31bf3856ad364e35_10.0.15063.0_none_dc3212611c2a948b\AddInUtil.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\amd64_wcf-smsvchost_b03f5f7f11d50a3a_10.0.15063.0_none_acba7ecbeae0a029\SMSvcHost.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_3.5.15063.0_none_806ce54f36ffda1c\MSBuild.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx35linq-datasvcutil_31bf3856ad364e35_10.0.15063.0_none_a06ab765d5c4f407\DataSvcUtil.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_10.0.15063.0_none_cd6f3f91779aa112\AddInUtil.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\x86_msbuild_b03f5f7f11d50a3a_10.0.15063.0_none_3a83aad74d9d5e68\MSBuild.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\amd64_wcf-servicemodelreg_b03f5f7f11d50a3a_10.0.15063.0_none_25f0a4bdfb1087e3\ServiceModelReg.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\amd64_wpf-presentationfontcache_31bf3856ad364e35_10.0.15063.0_none_16ad70084afccb22\PresentationFontCache.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\msil_smsvchost_b03f5f7f11d50a3a_10.0.15063.0_none_cbaa590df0d6f1ef\SMSvcHost.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\EdmGen.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\x86_caspol_b03f5f7f11d50a3a_10.0.15063.0_none_25273e3a8c447964\CasPol.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx35linq-edmgen_31bf3856ad364e35_10.0.15063.0_none_bf8fd14b74ad4dc1\EdmGen.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\msil_jsc_b03f5f7f11d50a3a_10.0.15063.0_none_61248a6e73dcd239\jsc.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx-dfsvc_b03f5f7f11d50a3a_10.0.15063.0_none_7ba4fd2e9a959f80\dfsvc.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\msil_ieexec_b03f5f7f11d50a3a_10.0.15063.0_none_3830d2bda4126472\IEExec.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\x86_aspnet_regsql_b03f5f7f11d50a3a_10.0.15063.0_none_092aa9735899975c\aspnet_regsql.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\x86_msbuild_b03f5f7f11d50a3a_3.5.15063.0_none_244e49cb7ea268e6\MSBuild.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
File opened for modification	C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.15063.0_none_7b0b6115a0fbb545\aspnet_regbrowsers.exe	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.execsc.exe

description	pid	process	target process
PID 708 wrote to memory of 3364	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 708 wrote to memory of 3364	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 3364 wrote to memory of 2376	3364	csc.exe	cvtres.exe
PID 3364 wrote to memory of 2376	3364	csc.exe	cvtres.exe
PID 708 wrote to memory of 948	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 708 wrote to memory of 948	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 948 wrote to memory of 1184	948	csc.exe	cvtres.exe
PID 948 wrote to memory of 1184	948	csc.exe	cvtres.exe
PID 708 wrote to memory of 3772	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 708 wrote to memory of 3772	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 3772 wrote to memory of 3480	3772	csc.exe	cvtres.exe
PID 3772 wrote to memory of 3480	3772	csc.exe	cvtres.exe
PID 708 wrote to memory of 3628	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 708 wrote to memory of 3628	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 3628 wrote to memory of 3904	3628	csc.exe	cvtres.exe
PID 3628 wrote to memory of 3904	3628	csc.exe	cvtres.exe
PID 708 wrote to memory of 4052	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 708 wrote to memory of 4052	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 4052 wrote to memory of 3200	4052	csc.exe	cvtres.exe
PID 4052 wrote to memory of 3200	4052	csc.exe	cvtres.exe
PID 708 wrote to memory of 1836	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 708 wrote to memory of 1836	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 1836 wrote to memory of 868	1836	csc.exe	cvtres.exe
PID 1836 wrote to memory of 868	1836	csc.exe	cvtres.exe
PID 708 wrote to memory of 1172	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 708 wrote to memory of 1172	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 1172 wrote to memory of 192	1172	csc.exe	cvtres.exe
PID 1172 wrote to memory of 192	1172	csc.exe	cvtres.exe
PID 708 wrote to memory of 1408	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 708 wrote to memory of 1408	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 1408 wrote to memory of 396	1408	csc.exe	cvtres.exe
PID 1408 wrote to memory of 396	1408	csc.exe	cvtres.exe
PID 708 wrote to memory of 3172	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 708 wrote to memory of 3172	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 3172 wrote to memory of 2132	3172	csc.exe	cvtres.exe
PID 3172 wrote to memory of 2132	3172	csc.exe	cvtres.exe
PID 708 wrote to memory of 2180	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 708 wrote to memory of 2180	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 2180 wrote to memory of 2332	2180	csc.exe	cvtres.exe
PID 2180 wrote to memory of 2332	2180	csc.exe	cvtres.exe
PID 708 wrote to memory of 1676	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 708 wrote to memory of 1676	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 1676 wrote to memory of 3256	1676	csc.exe	cvtres.exe
PID 1676 wrote to memory of 3256	1676	csc.exe	cvtres.exe
PID 708 wrote to memory of 3200	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 708 wrote to memory of 3200	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 3200 wrote to memory of 640	3200	csc.exe	cvtres.exe
PID 3200 wrote to memory of 640	3200	csc.exe	cvtres.exe
PID 708 wrote to memory of 916	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 708 wrote to memory of 916	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 916 wrote to memory of 1900	916	csc.exe	cvtres.exe
PID 916 wrote to memory of 1900	916	csc.exe	cvtres.exe
PID 708 wrote to memory of 2300	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 708 wrote to memory of 2300	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 2300 wrote to memory of 504	2300	csc.exe	cvtres.exe
PID 2300 wrote to memory of 504	2300	csc.exe	cvtres.exe
PID 708 wrote to memory of 1408	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 708 wrote to memory of 1408	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 1408 wrote to memory of 3480	1408	csc.exe	cvtres.exe
PID 1408 wrote to memory of 3480	1408	csc.exe	cvtres.exe
PID 708 wrote to memory of 3544	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 708 wrote to memory of 3544	708	df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe	csc.exe
PID 3544 wrote to memory of 2248	3544	csc.exe	cvtres.exe
PID 3544 wrote to memory of 2248	3544	csc.exe	cvtres.exe

C:\Users\Admin\AppData\Local\Temp\df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe
"C:\Users\Admin\AppData\Local\Temp\df08507c6c88ba6560b6fe3533a041f4fe7cde511d3165cc8fa7335fc8ea36d3.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:708

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x0i5-nka.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:3364

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF94.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFF93.tmp"
3⤵
PID:2376

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f_wq2bfb.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7E.tmp"
3⤵
PID:1184

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\6boxhdun.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:3772

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2983.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2982.tmp"
3⤵
PID:3480

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\efr8ax1f.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:3628

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2A5D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2A5C.tmp"
3⤵
PID:3904

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ywj5jkpf.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:4052

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2BD4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2BD3.tmp"
3⤵
PID:3200

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a91y6vrk.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:1836

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2CBF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2CAE.tmp"
3⤵
PID:868

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\668golsr.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:1172

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E65.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2E64.tmp"
3⤵
PID:192

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qnwmjlng.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2F30.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2F2F.tmp"
3⤵
PID:396

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\waze7oe_.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:3172

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3039.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3038.tmp"
3⤵
PID:2132

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4xedkluv.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:2180

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3105.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3104.tmp"
3⤵
PID:2332

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kxrqumuc.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3337.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3336.tmp"
3⤵
PID:3256

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j5mubrij.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:3200

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3441.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3440.tmp"
3⤵
PID:640

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\e5df9d0-.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES35B8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC35B7.tmp"
3⤵
PID:1900

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g64odyh6.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:2300

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3683.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3682.tmp"
3⤵
PID:504

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cm16jy4o.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:1408

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES379C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC379B.tmp"
3⤵
PID:3480

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vlm4_sa6.cmdline"
2⤵
- Suspicious use of WriteProcessMemory
PID:3544

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3848.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3847.tmp"
3⤵
PID:2248

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lkstxlvb.cmdline"
2⤵
PID:2332

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4577.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4576.tmp"
3⤵
PID:2264

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zjcxynjf.cmdline"
2⤵
PID:3448

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4604.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4603.tmp"
3⤵
PID:1488

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qv4j-mco.cmdline"
2⤵
PID:1880

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES46EE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC46ED.tmp"
3⤵
PID:2864

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mvdsu9uo.cmdline"
2⤵
PID:2120

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES477B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC477A.tmp"
3⤵
PID:204

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\_g6jeokx.cmdline"
2⤵
PID:2376

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4865.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4864.tmp"
3⤵
PID:4024

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i1mcawtj.cmdline"
2⤵
PID:1360

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES48F2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC48F1.tmp"
3⤵
PID:3040

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\6ksophyk.cmdline"
2⤵
PID:1576

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES49CC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC49CB.tmp"
3⤵
PID:1344

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g8s2mmdg.cmdline"
2⤵
PID:732

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A97.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4A96.tmp"
3⤵
PID:2324

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dxant8po.cmdline"
2⤵
PID:2304

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B72.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4B62.tmp"
3⤵
PID:3492

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vngxnyei.cmdline"
2⤵
PID:424

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4BEF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4BEE.tmp"
3⤵
PID:2760

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mcfwqrvx.cmdline"
2⤵
PID:768

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4CCA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4CC9.tmp"
3⤵
PID:1836

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\03c8dsc1.cmdline"
2⤵
PID:780

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4D47.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4D46.tmp"
3⤵
PID:1496

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fimtwdeu.cmdline"
2⤵
PID:188

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E22.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4E21.tmp"
3⤵
PID:584

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zcfimmwo.cmdline"
2⤵
PID:512

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4EBE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4EBD.tmp"
3⤵
PID:3812

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jjgcxaoh.cmdline"
2⤵
PID:2436

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4F99.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4F88.tmp"
3⤵
PID:2248

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3abfuj7c.cmdline"
2⤵
PID:2192

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5025.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5024.tmp"
3⤵
PID:3540

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jltbanil.cmdline"
2⤵
PID:2252

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5100.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC50EF.tmp"
3⤵
PID:2304

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wdgeb4ve.cmdline"
2⤵
PID:2264

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES518D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC517C.tmp"
3⤵
PID:1676

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ivrocgbu.cmdline"
2⤵
PID:2760

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5258.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5257.tmp"
3⤵
PID:3900

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oz9tmo66.cmdline"
2⤵
PID:208

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5333.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5332.tmp"
3⤵
PID:1172

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gc6q6mk7.cmdline"
2⤵
PID:204

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES53FE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC53FD.tmp"
3⤵
PID:1332

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o7bc01sy.cmdline"
2⤵
PID:1968

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES548A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5489.tmp"
3⤵
PID:1360

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o2nxatlq.cmdline"
2⤵
PID:2132

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5594.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5593.tmp"
3⤵
PID:1316

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\slppbsbc.cmdline"
2⤵
PID:3544

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5630.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC562F.tmp"
3⤵
PID:3480

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\obiarwpy.cmdline"
2⤵
PID:3772

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES572A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5729.tmp"
3⤵
PID:3928

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\efacscnt.cmdline"
2⤵
PID:2304

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES57C6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC57C5.tmp"
3⤵
PID:3984

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hmrbw_zy.cmdline"
2⤵
PID:3020

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES58B1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC58B0.tmp"
3⤵
PID:1880

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zu0l3n8z.cmdline"
2⤵
PID:3900

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES595D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC594C.tmp"
3⤵
PID:1448

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eka_wntc.cmdline"
2⤵
PID:1900

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5A28.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5A27.tmp"
3⤵
PID:2752

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ua5ydsqr.cmdline"
2⤵
PID:4068

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5AB4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5AB3.tmp"
3⤵
PID:1332

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\6q1g8h_y.cmdline"
2⤵
PID:2312

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5B8F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5B8E.tmp"
3⤵
PID:1828

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bcecinn8.cmdline"
2⤵
PID:396

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5C1C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5C1B.tmp"
3⤵
PID:2308

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vmgfe76i.cmdline"
2⤵
PID:3536

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5CF7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5CF6.tmp"
3⤵
PID:3992

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vcqqvf_k.cmdline"
2⤵
PID:2192

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5DA2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5DA1.tmp"
3⤵
PID:4012

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\goy1sbhv.cmdline"
2⤵
PID:2268

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E8D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5E8C.tmp"
3⤵
PID:2304

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\j2vkoivr.cmdline"
2⤵
PID:3160

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5F39.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5F38.tmp"
3⤵
PID:1036

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jmmgp83a.cmdline"
2⤵
PID:1448

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6004.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6003.tmp"
3⤵
PID:780

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\axb8sbna.cmdline"
2⤵
PID:2752

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES60B0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC609F.tmp"
3⤵
PID:3276

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xtdcpv2o.cmdline"
2⤵
PID:1332

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES618A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6189.tmp"
3⤵
PID:2300

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ik4kqr_p.cmdline"
2⤵
PID:1360

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6227.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6226.tmp"
3⤵
PID:2312

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m-4ca_m0.cmdline"
2⤵
PID:548

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES62E2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC62E1.tmp"
3⤵
PID:396

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nzc6zcww.cmdline"
2⤵
PID:2100

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES639E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC638D.tmp"
3⤵
PID:3992

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wfiejpwn.cmdline"
2⤵
PID:1240

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6478.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6477.tmp"
3⤵
PID:2180

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\7voros_l.cmdline"
2⤵
PID:700

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6515.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6514.tmp"
3⤵
PID:424

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xqelmku0.cmdline"
2⤵
PID:640

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6841.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6831.tmp"
3⤵
PID:3424

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ep8zsrnj.cmdline"
2⤵
PID:644

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES68ED.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC68EC.tmp"
3⤵
PID:3200

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o98elp7w.cmdline"
2⤵
PID:2588

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6A26.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6A25.tmp"
3⤵
PID:2120

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jqd-w-qc.cmdline"
2⤵
PID:1312

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6AD1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6AD0.tmp"
3⤵
PID:2936

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dj0qylgv.cmdline"
2⤵
PID:1928

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6BAC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6BAB.tmp"
3⤵
PID:3732

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ahvqivsj.cmdline"
2⤵
PID:1184

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6CB6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6CB5.tmp"
3⤵
PID:1016

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ne4bgtgy.cmdline"
2⤵
PID:1320

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6DB0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6D9F.tmp"
3⤵
PID:1576

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sqettbib.cmdline"
2⤵
PID:2324

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6E4C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6E4B.tmp"
3⤵
PID:3772

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xkkikrex.cmdline"
2⤵
PID:3492

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6F27.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6F26.tmp"
3⤵
PID:3128

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nma95qqe.cmdline"
2⤵
PID:3208

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6FC3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC6FC2.tmp"
3⤵
PID:1428

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mh40ibu_.cmdline"
2⤵
PID:2156

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES709E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC708D.tmp"
3⤵
PID:2760

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oudkka6p.cmdline"
2⤵
PID:912

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES71B7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC71A6.tmp"
3⤵
PID:1900

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kxofszpj.cmdline"
2⤵
PID:1120

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7273.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7272.tmp"
3⤵
PID:1568

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oqs336k6.cmdline"
2⤵
PID:2312

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES730F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC730E.tmp"
3⤵
PID:3732

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jwbc27xx.cmdline"
2⤵
PID:4024

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES73F9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC73E9.tmp"
3⤵
PID:1016

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xrf1xc0h.cmdline"
2⤵
PID:2308

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7495.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7494.tmp"
3⤵
PID:2100

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iw-eeiza.cmdline"
2⤵
PID:3536

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7570.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC756F.tmp"
3⤵
PID:3772

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jy8_jnpo.cmdline"
2⤵
PID:2192

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES760C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC760B.tmp"
3⤵
PID:3128

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hxg-zgoc.cmdline"
2⤵
PID:1676

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7706.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7705.tmp"
3⤵
PID:1428

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i8vdxmg0.cmdline"
2⤵
PID:3424

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7793.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7792.tmp"
3⤵
PID:2760

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pwdz7tef.cmdline"
2⤵
PID:2864

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES785E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC784E.tmp"
3⤵
PID:1900

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\13u-dfl_.cmdline"
2⤵
PID:1172

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES78FA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC78F9.tmp"
3⤵
PID:188

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pal42hp2.cmdline"
2⤵
PID:1120

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA923.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA922.tmp"
3⤵
PID:3040

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\8lwximkb.cmdline"
2⤵
PID:2312

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA9BF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA9BE.tmp"
3⤵
PID:3532

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iu4z_dea.cmdline"
2⤵
PID:4024

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAA9A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAA99.tmp"
3⤵
PID:3544

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5gpql3ma.cmdline"
2⤵
PID:2308

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB45.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAB35.tmp"
3⤵
PID:2184

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\voi50c6k.cmdline"
2⤵
PID:3536

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAC30.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAC1F.tmp"
3⤵
PID:3676

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wnavibma.cmdline"
2⤵
PID:2192

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESACDC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCACCB.tmp"
3⤵
PID:640

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rjha3sqc.cmdline"
2⤵
PID:1676

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESADC6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCADC5.tmp"
3⤵
PID:644

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m5jdpmg7.cmdline"
2⤵
PID:3424

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE62.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAE61.tmp"
3⤵
PID:1496

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\01cyagmi.cmdline"
2⤵
PID:2864

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF2D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAF1D.tmp"
3⤵
PID:204

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vz6jgv4d.cmdline"
2⤵
PID:1172

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAFBA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAFB9.tmp"
3⤵
PID:1888

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\laro9xcx.cmdline"
2⤵
PID:2452

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB095.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB094.tmp"
3⤵
PID:2152

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ogce0y5k.cmdline"
2⤵
PID:2564

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB131.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB130.tmp"
3⤵
PID:2300

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kcneusad.cmdline"
2⤵
PID:772

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB20C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB20B.tmp"
3⤵
PID:2276

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x2kql37t.cmdline"
2⤵
PID:1016

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB2A8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB2A7.tmp"
3⤵
PID:2204

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\idqjpgzb.cmdline"
2⤵
PID:2100

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB383.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB382.tmp"
3⤵
PID:1048

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ekxivc-6.cmdline"
2⤵
PID:3772

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB42F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB42E.tmp"
3⤵
PID:3008

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ernfnaxs.cmdline"
2⤵
PID:2252

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB509.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB4F9.tmp"
3⤵
PID:3052

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ku_muz5o.cmdline"
2⤵
PID:1428

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB586.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB585.tmp"
3⤵
PID:780

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vl01java.cmdline"
2⤵
PID:2760

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB6A0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB68F.tmp"
3⤵
PID:656

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2hd-ba4n.cmdline"
2⤵
PID:3364

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB73C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB73B.tmp"
3⤵
PID:3276

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wjqoqmhq.cmdline"
2⤵
PID:188

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB865.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB864.tmp"
3⤵
PID:1844

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ihb8bx5m.cmdline"
2⤵
PID:1628

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB901.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB900.tmp"
3⤵
PID:2056

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bxin8n-p.cmdline"
2⤵
PID:1256

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB9EB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB9EA.tmp"
3⤵
PID:3040

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yg0tdzqb.cmdline"
2⤵
PID:4068

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBAA7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBAA6.tmp"
3⤵
PID:3548

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vw2pk4yi.cmdline"
2⤵
PID:1832

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD8ED.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD8EC.tmp"
3⤵
PID:3544

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\8s59m6ah.cmdline"
2⤵
PID:196

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD9A8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD9A7.tmp"
3⤵
PID:1240

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\twnptnrr.cmdline"
2⤵
PID:504

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFA7F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFA7E.tmp"
3⤵
PID:1184

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\42lt-imr.cmdline"
2⤵
PID:2436

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFB0B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFB0A.tmp"
3⤵
PID:1320

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ieievieu.cmdline"
2⤵
PID:3676

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDE7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCDE6.tmp"
3⤵
PID:2324

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dzesenk1.cmdline"
2⤵
PID:3160

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE84.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE83.tmp"
3⤵
PID:3492

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kimx7pvo.cmdline"
2⤵
PID:3920

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF6E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF6D.tmp"
3⤵
PID:3900

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yhtwuzur.cmdline"
2⤵
PID:1496

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1039.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1038.tmp"
3⤵
PID:1568

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\d7u4vsha.cmdline"
2⤵
PID:2864

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1133.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1132.tmp"
3⤵
PID:912

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\d7n3tejh.cmdline"
2⤵
PID:1344

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES11DF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC11DE.tmp"
3⤵
PID:2200

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2cps3aar.cmdline"
2⤵
PID:3904

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES12BA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC12B9.tmp"
3⤵
PID:2536

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0xj4tjqd.cmdline"
2⤵
PID:3300

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1356.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1355.tmp"
3⤵
PID:3480

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zrvuh57q.cmdline"
2⤵
PID:3544

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1450.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC144F.tmp"
3⤵
PID:196

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g-v9pcil.cmdline"
2⤵
PID:2132

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES14EC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC14EB.tmp"
3⤵
PID:3728

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u5fjm_ri.cmdline"
2⤵
PID:948

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1867.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1866.tmp"
3⤵
PID:868

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qzd6hhlv.cmdline"
2⤵
PID:3536

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1913.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1912.tmp"
3⤵
PID:780

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\8mcxykhb.cmdline"
2⤵
PID:4052

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3EAC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3EAB.tmp"
3⤵
PID:656

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jlztfhpa.cmdline"
2⤵
PID:3256

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F48.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3F47.tmp"
3⤵
PID:3276

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\-yzorz4m.cmdline"
2⤵
PID:1448

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4042.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4041.tmp"
3⤵
PID:1272

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sx3eyjvo.cmdline"
2⤵
PID:2120

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES40EE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC40ED.tmp"
3⤵
PID:2056

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\o-vccomv.cmdline"
2⤵
PID:2280

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES42D2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC42D1.tmp"
3⤵
PID:3812

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\h804dlb3.cmdline"
2⤵
PID:3688

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES435F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC434E.tmp"
3⤵
PID:4068

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\_ah1dior.cmdline"
2⤵
PID:420

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES442A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4429.tmp"
3⤵
PID:1832

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bd5ihgxk.cmdline"
2⤵
PID:3932

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES44C6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC44C5.tmp"
3⤵
PID:1312

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sfgjnz7l.cmdline"
2⤵
PID:1828

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4591.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4590.tmp"
3⤵
PID:984

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\veugbgyb.cmdline"
2⤵
PID:2860

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES461E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC461D.tmp"
3⤵
PID:1036

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3kfzvhnk.cmdline"
2⤵
PID:948

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4737.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4727.tmp"
3⤵
PID:644

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aqsn-hxz.cmdline"
2⤵
PID:2308

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES47A5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC47A4.tmp"
3⤵
PID:4056

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xz3tcqnz.cmdline"
2⤵
PID:1500

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES488F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC488E.tmp"
3⤵
PID:2856

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nivpwvb0.cmdline"
2⤵
PID:1900

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES492B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC492A.tmp"
3⤵
PID:1716

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ezyqja8w.cmdline"
2⤵
PID:1568

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4A16.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4A15.tmp"
3⤵
PID:2344

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qbrm3gvc.cmdline"
2⤵
PID:1792

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4AA2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4AA1.tmp"
3⤵
PID:3040

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\du0cbv-t.cmdline"
2⤵
PID:1756

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4B8D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4B7C.tmp"
3⤵
PID:2536

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rfguw5v8.cmdline"
2⤵
PID:2044

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4C48.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4C47.tmp"
3⤵
PID:3480

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2uvafoky.cmdline"
2⤵
PID:3904

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES52A1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC52A0.tmp"
3⤵
PID:196

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gpx8ytvs.cmdline"
2⤵
PID:588

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES532E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC532D.tmp"
3⤵
PID:3728

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\6qlm23ek.cmdline"
2⤵
PID:1196

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES53F9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC53F8.tmp"
3⤵
PID:3052

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cdk119ib.cmdline"
2⤵
PID:2860

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES54A5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC54A4.tmp"
3⤵
PID:780

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bv3qu3pu.cmdline"
2⤵
PID:3924

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES562B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC562A.tmp"
3⤵
PID:2180

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kljk7cid.cmdline"
2⤵
PID:2308

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES56C8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC56C7.tmp"
3⤵
PID:3276

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xkuppzd3.cmdline"
2⤵
PID:4052

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES57A2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC57A1.tmp"
3⤵
PID:1272

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gfomaxdg.cmdline"
2⤵
PID:3448

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES583F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC583E.tmp"
3⤵
PID:2056

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\13fi914c.cmdline"
2⤵
PID:1448

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5958.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5957.tmp"
3⤵
PID:3812

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vkw2ttuq.cmdline"
2⤵
PID:2120

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5A13.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5A12.tmp"
3⤵
PID:4068

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\adjozbak.cmdline"
2⤵
PID:2280

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5AFE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5AFD.tmp"
3⤵
PID:1832

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c0xz73lp.cmdline"
2⤵
PID:3688

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5B8A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5B7A.tmp"
3⤵
PID:3860

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ze7anjcd.cmdline"
2⤵
PID:3904

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5EC7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5EC6.tmp"
3⤵
PID:1184

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r17hyxhj.cmdline"
2⤵
PID:588

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5F72.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC5F62.tmp"
3⤵
PID:640

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pdywlw2r.cmdline"
2⤵
PID:1828

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES606C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC606B.tmp"
3⤵
PID:644

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\7ztyaklp.cmdline"
2⤵
PID:3540

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES60F9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC60F8.tmp"
3⤵
PID:656

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uouvqg2x.cmdline"
2⤵
PID:948

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES61E3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC61E2.tmp"
3⤵
PID:2856

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mdsrb5ba.cmdline"
2⤵
PID:1492

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6270.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC626F.tmp"
3⤵
PID:1716

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\-cvxzbof.cmdline"
2⤵
PID:1500

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7FCC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC7FCB.tmp"
3⤵
PID:2344

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ucl0ois9.cmdline"
2⤵
PID:3256

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8068.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8067.tmp"
3⤵
PID:3040

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xzday-yt.cmdline"
2⤵
PID:1568

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8152.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8151.tmp"
3⤵
PID:2536

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\w0nmuppw.cmdline"
2⤵
PID:2376

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES81EF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC81EE.tmp"
3⤵
PID:3480

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qyc3nzgt.cmdline"
2⤵
PID:1756

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8308.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8307.tmp"
3⤵
PID:2312

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\neivyuxs.cmdline"
2⤵
PID:3688

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8394.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8393.tmp"
3⤵
PID:984

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3l0eqkca.cmdline"
2⤵
PID:512

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES848E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC848D.tmp"
3⤵
PID:3052

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\8hbq9dtv.cmdline"
2⤵
PID:772

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES852B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC852A.tmp"
3⤵
PID:780

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ftsnsipm.cmdline"
2⤵
PID:1048

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES85F6.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC85F5.tmp"
3⤵
PID:2180

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t0tyjplj.cmdline"
2⤵
PID:2860

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8692.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8681.tmp"
3⤵
PID:3276

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kiy93akm.cmdline"
2⤵
PID:3924

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES876D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC876C.tmp"
3⤵
PID:1272

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jv-xkzky.cmdline"
2⤵
PID:2308

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES87F9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC87F8.tmp"
3⤵
PID:1604

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t422vweg.cmdline"
2⤵
PID:2864

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES88E4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC88E3.tmp"
3⤵
PID:1256

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ovv7ycgo.cmdline"
2⤵
PID:848

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8970.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8960.tmp"
3⤵
PID:3532

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4y7weu8y.cmdline"
2⤵
PID:1120

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8A3C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8A3B.tmp"
3⤵
PID:3196

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2bjkqnji.cmdline"
2⤵
PID:4032

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8AE7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8AE6.tmp"
3⤵
PID:1016

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bj3yglxs.cmdline"
2⤵
PID:728

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C8D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8C8C.tmp"
3⤵
PID:3772

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cnsmxph8.cmdline"
2⤵
PID:1316

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8E33.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8E32.tmp"
3⤵
PID:2252

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bk315nmp.cmdline"
2⤵
PID:4012

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F5C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8F5B.tmp"
3⤵
PID:3696

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rp3z067e.cmdline"
2⤵
PID:2268

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9056.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9055.tmp"
3⤵
PID:424

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cs3paazp.cmdline"
2⤵
PID:648

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9140.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC913F.tmp"
3⤵
PID:204

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ndwkg_rb.cmdline"
2⤵
PID:2856

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES91CD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC91BC.tmp"
3⤵
PID:1888

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x2fowjg9.cmdline"
2⤵
PID:3916

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC2B1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC2B0.tmp"
3⤵
PID:2156

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\_jxeznia.cmdline"
2⤵
PID:2100

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC35D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC35C.tmp"
3⤵
PID:1172

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\v_cs_jbt.cmdline"
2⤵
PID:1060

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD09B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD09A.tmp"
3⤵
PID:4028

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m0dg__ls.cmdline"
2⤵
PID:1876

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD128.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD127.tmp"
3⤵
PID:1968

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mjfr7dkq.cmdline"
2⤵
PID:2104

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD222.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD221.tmp"
3⤵
PID:2312

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\npw1zqci.cmdline"
2⤵
PID:2936

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD2BE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD2BD.tmp"
3⤵
PID:1360

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fwykczfk.cmdline"
2⤵
PID:3300

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD37A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD379.tmp"
3⤵
PID:3128

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\-1sky6nz.cmdline"
2⤵
PID:3112

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD416.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD415.tmp"
3⤵
PID:780

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xptr2bfz.cmdline"
2⤵
PID:1408

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD500.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD4FF.tmp"
3⤵
PID:3676

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gmsz2mye.cmdline"
2⤵
PID:2304

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD58D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD58C.tmp"
3⤵
PID:3628

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bitrpkl1.cmdline"
2⤵
PID:2180

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD687.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD686.tmp"
3⤵
PID:208

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t77e91by.cmdline"
2⤵
PID:3008

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD733.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD732.tmp"
3⤵
PID:912

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\oya_go1_.cmdline"
2⤵
PID:3208

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD8E8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD8E7.tmp"
3⤵
PID:3040

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wf2imsdg.cmdline"
2⤵
PID:1428

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD984.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD974.tmp"
3⤵
PID:4028

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wtswlx5i.cmdline"
2⤵
PID:2152

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE145.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE134.tmp"
3⤵
PID:1968

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fi5sfxf1.cmdline"
2⤵
PID:3732

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE1E1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE1E0.tmp"
3⤵
PID:2276

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nag3mc-o.cmdline"
2⤵
PID:2564

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE2BC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE2BB.tmp"
3⤵
PID:1360

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\av8hdesc.cmdline"
2⤵
PID:1332

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE368.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCE367.tmp"
3⤵
PID:3128

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RES2983.tmp
MD5
e32eb2aa6b8f4b55261fa91e11c5470b

SHA1
120145488d8f0624935e6e72e704d1b3926510a4

SHA256
42ae292b879a4b1a86fe4ab5b635a67141156d478096a5aabb8209d0caaf1042

SHA512
bd80df9af1204cc4ae1128eeed8aa1bdf384a06cdf2264b55145a8bd5e66f4f9f23d0c931f3e1574e988811ed1e9132f36f720b4cd4e08e521d7e88d566c7f87

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2A5D.tmp
MD5
71d9959085bb952b4682f29db9970167

SHA1
2b9d4b7b5d9b398655ad75f5a2379542d189e2b2

SHA256
d18113436284b6a97ff091cb30d6fcdabd94de5afc0593e9663ac45848d3e7ec

SHA512
dd8ca82d4fa9151baf32a8c4188f8fcf7cbeeefa8fb4954d5c58eba9f7daa3fe610e36f286232ee1e9abbd7b680eda1362364a405412e1659b8d943c29b4e12e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2BD4.tmp
MD5
94d91134506a5eb3fc1e17dacf938013

SHA1
9699f2ad3cd93f9b569d3b7d9a2448c57cfd3b7c

SHA256
0addab19acf2df7dcaf9ecf75eed768e5a7c105a95be72ffe0579354cd248201

SHA512
a41f537935d52a0f6260249e00f840b9dc871756367bb082ff1937c4f7037e7021a71841832deded760b3932d404ea2eb01cee53f8690a59e312096cd0ccc2c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2CBF.tmp
MD5
6eb897bf020e249dd98c3f7b7115460a

SHA1
a5fbb747f7ef8846061b6a1745a32d9f5a20ac94

SHA256
b426709d5e96bd32432f0d570d374eb2305f6c5241429e5f11dec01200329ce6

SHA512
62c1358ad4c2d64fd9394ef6b3b0b600667bf433cab882ebbf53a187618a27302d20e2b623fd4160f4f70c039aef8fd37a732d5b6859104f8331dfc25217ed2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2E65.tmp
MD5
b2d1a00b835ebe14dc9f7bf3e92dff2d

SHA1
02166d7bfcdfb86d3971593ffedf70f85f729e77

SHA256
67c151ff88cb9d9261fcb68d22af3298f66917e861b77ba9a7b2d335c6e81f5d

SHA512
4a9d0d0394c8c47e81e44f203c40a4d392e6ccbd2527e4dd2a43f37da77db6dc03d29e48fa002e758678b65fa939b7717c9188626a8226c606809e952c5cd0a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES2F30.tmp
MD5
6030b5f21a3ffad79e6605a4571f7688

SHA1
56b2eefddc7a8e21c619bf2c92726e1e72cb131f

SHA256
e527c5ff8697103de505c148fa9fd33a9a91ef17f5bb09996343c5e897056ad8

SHA512
51d4a570ba7f3911acc4f12daa393a34e66079f39c3c37746b8480c7c807b7e25821685abf6bdd468777ee0672293bb8dc35fcecd020b384cd223bbbae81a96c

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3039.tmp
MD5
7d5072691d07cccfcd19723a57570b03

SHA1
334207a6b6fd95656c83004c9a305ba4852c46f2

SHA256
4ef3b98b9eb21ee7789103ff1f8af53a702ac86b7820f2b957c9af9211a13ace

SHA512
e48619cc13ddb95b57d148c3a831c308bc12851208e29f0421690450743d96ec34600eda96b7730b07912d2087d29246776005b644ac3aff17b813213ad55924

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3105.tmp
MD5
be648c1d281532a6dc92742aaec65f3d

SHA1
4b63911bca3374b7d674cd4651f323ff7eb808b4

SHA256
755de036f03e2c66b2e8a2fcbcd1bed835272b704854924dbfbfcf49863fa247

SHA512
f416b717b4a0ae0faea4775ad402da2b0abd0030c4a3ea1916581475e132a9384c6cb49c19907ec457697234aa5c18cff6f8a3cc99018e7e016e998c221a0d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3337.tmp
MD5
d40584d6d7566d1fa41b16919dd9bccb

SHA1
6925b98fd3a92a253bf00a9aea2a090e288d0d1c

SHA256
2e61cdb4229bba79a319324824b599af7ea51a9ad335d97d843bc352536b3aea

SHA512
1a2da709f28518bbdc26635c65d9db75caf8b36bc08a7e30ba75d196a4f39118db212f99c1eb9a0de12c928b10de34e23f4aa12f8a2ffcfe51d854c58cf97d58

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES3441.tmp
MD5
fdd982e1220162240e21cb47ec5dd122

SHA1
9d40b9b2c2cf18334d046fd0e52e00ea4b87948f

SHA256
d8a8e85b24086448b2d8a1d5fb6990afcdc0a1c1e1e77b07f7c805e2b97b4e06

SHA512
0e6a567c0eea5cf39aa3df796a94a65a66ff8204bd84bd8c925734967f3dc77d2c6ef72244e992d0e2ec7aadf7b68823c6e5f7560d82b93c86f9bd93979b5792

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES35B8.tmp
MD5
26e45ec8f170a1e3663d7c2c9d1c4bb3

SHA1
4e6329e4e531b82c8a3fc2ee60d0c22ac29fd50c

SHA256
7ca912a0ccaeaf0aee115e53b80035ccb7dccfdbec31fc506e30d3b50ca67cb3

SHA512
1b0a2ff241e125c177d10f56c33b9368797e85e4c0fb5bb049365b42c0e755ab87a1c54f7cacd6b5552b301cdba9d13057fb621eef32e8363b498ba578de5462

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES7F.tmp
MD5
f0a82270b53332dfa39f0ae4c177332d

SHA1
cd17bbecb8ea480544b2907fda743033860ee182

SHA256
f3331a8f0e66e0c6cf23ea1be3f844bf2cab180c9a7bca53812df9ced728281a

SHA512
7254d6b8c8ad8ce1a82ee2f1f143d31ec9f67008f8dd68dbadaea1061a3e726973c73f086823b35620da774ef8cd59bd60d7a1e3a5c636a7a045898a2ca2aa9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESFF94.tmp
MD5
c1f0b7ae9644a4c1c4ca9e231d7686ed

SHA1
2d305b3edb64912282af00328b7727a5b8239d6a

SHA256
dd77c25c2ef16d429e5fc939059076cea3616123c67e07ef34ddda0629361796

SHA512
9ee464413d3bbbfc7e952193ce1b7018f5f2723e27a8963ef0bf15a55eac8c789f687b18cdd26baea7317e4161ea45bdada748baf24ff66bfeec82cdc8325a1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\x1114y.exe
MD5
a3cb2897dfe63e874c0f39aae959ecb6

SHA1
b59a6cb6817afe48b5991cf40be11ac0dd0b2e5f

SHA256
6840055e0f230116c61bffafea72a84c4b83001eeff42c854427e1226a2ad009

SHA512
a759b0fecf98465c61930674cfd2086b0a22991e950934252c432526304bb375b93f3e2cbd844e661bcb3f94f515c6a3ef97e90be1e2aadf58e75276e899a2f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\x1114y.exe
MD5
f94b649eaa55d7924a3882ae29d001bb

SHA1
17ef6b60336eade0854060ea499bde2193f5bf4a

SHA256
dfa95e562f7cdbbbe551cc3e6a34b176869ec604eaff4fcb9d4a1a23aca36312

SHA512
3d4b18fd93dab885df5d831771076e39ae2f0a87559efdcd58468cd6d679a3d76f744627aa2bcf7907bbe945b55d548dc3ee77508db12be3243085f443ffaa88

Download Submit
C:\Users\Admin\AppData\Local\Temp\x1429y.exe
MD5
40148f142700469a619b813a73606296

SHA1
72761783d7a92b98318ef8f320f28c1cafef580e

SHA256
594a8c19ed3588200ed9ceae15c4adb5b9656403c98421ade52186a24141fca8

SHA512
2c2a783c0bdc9684720e1da2b4c80a4e2c9d9918648683d74ea4247d98288a903b7db6e39967414ec79113a6ea513181b706496564bfc2cfd03949aa48fcf66e

Download Submit
C:\Users\Admin\AppData\Local\Temp\x1429y.exe
MD5
216ad740e5c6e26f4722ec650f353fcd

SHA1
c2704e94788bfb6a0bc804b88f78a63ae098bebb

SHA256
16f80652fefc4c67dae03cf94ee7b2af6f62b04eb2baf235b303da6dec9fd879

SHA512
6bc1d47aa7cfe47738d887d6911d2648792e0bcd5772f2d96d24c9f0f345e28c9e42149bae3e14af84423428a3891ea17daeb0a947c8879191e32f55a8aa14e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\x1688y.exe
MD5
b591fb7455a322dea49f06acebf9e7ce

SHA1
8668c733301bc80712018c9e2369c3961db962c7

SHA256
f2787ba887e1ad3b67b93f5fe530f95dc549d67b824c50983e4ab81d104265fe

SHA512
91f8c3533408ceb0a2dd52002b50cae1d0e41055c78f1d394d0f500a5891becbc3762060ee21ecdc6ccaa16a7ef4f1816b090668dcbbf4a1d13de88e5ab07b56

Download Submit
C:\Users\Admin\AppData\Local\Temp\x1688y.exe
MD5
ee85c2fdd9c755531275a1c41b43aebc

SHA1
7be7e4d3df0203e407b26be462578ad81e7daf7e

SHA256
dd66ef5f73a5a7791ba2e07097f549e6b68c25d732bd9cb04b44aeab3e5242cd

SHA512
e0745248ab3eb2d34f87eff83d8504bd228bcccc4c38d160ce3bc43a78a8605b6c2f099069285f7be7a804fd0756e4c5b76c60ac9a3d4bc7e17573a906837019

Download Submit
C:\Users\Admin\AppData\Local\Temp\x1895y.exe
MD5
0c8c8afddac63bd2ec8a240219eba0ea

SHA1
3a4a993f194493efa82b22ed222569ac68c5b1bb

SHA256
38c8ad148e9e50250c9972d3e8c34cb40b8cafd9003f06040bf9623c81688f5d

SHA512
36d44726d96811a352eaa02b9a94ccc80192a5b0fe7354dbe916630b647afc02f6c4e2f0820fbd8e9b745b9ad3cbe9fc89fe28703824a87bca857ff2ce9642ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\x1895y.exe
MD5
eab3c88e572a5cfd2a5f185f60f9f187

SHA1
63b56acf3ab5ad2032b3125e8a94d441eebd7974

SHA256
5a342ac7d2d3df0be483f312009802555e911529eef5379bf14fd067ef798260

SHA512
92b013d0e82174f5eb23de9f3b6f05cfd0024392666d423b26900095d472713b55cc770c3d6f6436adda3614056e8836fe3f76b143ba7bead36cda0d3f701aa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\x321y.exe
MD5
5fc6eaef3b75b8da1c7aedf6828eb924

SHA1
07e5ea39d892a5e2a817343bc761c3cd3bb3038e

SHA256
560b17c6ba542321dd5cf5a915715f121b75af5912be440c90d4bba266a38afe

SHA512
2fe9311242fd0650e7d8589f59f35fb2cbe486c68afc2037698fa044497f85cbf04cfd61737c2232b98451f3d2fb348b810a7652290d1e3bd2dc1d9953009210

Download Submit
C:\Users\Admin\AppData\Local\Temp\x321y.exe
MD5
da368a66267c328e19dbb7756b63c260

SHA1
a7faf2feabb34d76e752b59cf7166163c25dd467

SHA256
40780ebcc80a865cb5a942ffb1e0e6c766ad534eb2abce1a80b972d1c5f4aabb

SHA512
38627885c68fe7bb6c8bcc5b3a4a45117aca33630fa838f2618bda09dfb0b68be7365ed2107b6d56e84358d89f93d98d3a4e6d5dae406c12e79d54e8df3f0883

Download Submit
C:\Users\Admin\AppData\Local\Temp\x349y.exe
MD5
184e6aefa0d4a6d9d6be9f941945a5fc

SHA1
d95ac5ff4dc28c2e89c7ac884da972079afb5b7c

SHA256
a62efd5c6af78b35b1120ebe3ceb2349b0c0c7f9ee5596bfad0e2f3043225e82

SHA512
ca9ef2645b4aa7ab9cf134529b9cadd6022b7d6ec1ebde7da348641b78c98fa50217d48b935ca703bd10f775a1c0ff62a79358eb707956d45b3e4942b67ac1d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\x349y.exe
MD5
dc7d34ffbf258c603d4eff37015e1e48

SHA1
122d1a9a4bce4c6d1b42e1399c4ea807ffb9aead

SHA256
bfd273a14c796f8df7db4b48ffcff9a2c7178370e5b637476529fc9cd9c0fa34

SHA512
4ad1b5ebf4d118b338b9b875f5434ffbae544e3e58238ea71fbe9f816f2de8db232138f2533b10468daf875e667dc0bc2f2972602b0fc80ecc42fbafc0a96d9a

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4xedkluv.0.cs
MD5
425643247bc8b6c189f89175bb9a8eb2

SHA1
fe72c078bdbdf02c68ab2ddf2d88b29923634f07

SHA256
520e8f73169626626d71c54fd9adc867bde1c5c7432d56dfe25eb5bb587f08e5

SHA512
1657d9ef76d8f8871eb054525ce6308976cc06222ea41c3d5323cf453be55b3172881dc5ddf82eff4c8bcab7d357b200c58760a2fcea7c8e0242e059eba025c6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4xedkluv.cmdline
MD5
fe36535db933026771093317e628f24b

SHA1
0acb25f9216aae48045dd536beeb8171af05cafc

SHA256
8b2b3693fd83185fa1b69cd8382c5aee75e216f7d14ac895bb64686f8ba4e5ff

SHA512
1dad281d096010115a4cb546f962c2e08e2a1a830b5f684fa57893052074120b54ce3e5d4908d7971db71fbfbaf04900599049576514bd94ffed2496b6a01ef6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\668golsr.0.cs
MD5
add1da456aa7bdcaaa7999f24bd75064

SHA1
541f39fd5f90dc6406595298ac46bcd1c42d4b62

SHA256
50fc893201c3e8048eb50782b98c73259ae2411831e7d1e0470dd27dab38bea7

SHA512
1b2d6066b300092ce403f4a4aaf732a2ae988ba2e570880a835bd6521f41b015897537a9aca2f2035d859046bc5641caf598edf3b65d7d35cf057b47c8dddffe

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\668golsr.cmdline
MD5
ec1b95fe92c17e0225ae3007974cd2b6

SHA1
35cd73c2871ceafaf2d3489e43925874025be0f7

SHA256
f427a72cca66d5860fccfd2d50b3116bee91e3feaa03ee9e17f4a9f6a8e97da4

SHA512
b77bd62da2a0d3ad9e31dd9a681c64b98aa974a66c335434e08b84c547c7feb480c966f6d28895d33bfae496a5583c5dd7ad808f29c97ea3d52c19b741247cd7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\6boxhdun.0.cs
MD5
1f2d474d83ea7f25519fae64289b0d65

SHA1
c841c7ff0094db67600f514c5bdc31558476fa8d

SHA256
24cf780badc44ad11a1b38f639b2803f5abadf5ad1c7f9cedaa628972a7e9638

SHA512
e18df03510fc93a60a6ff0fa2f09fb29fa7dba1e9b250e986331426614a004797dd725710516ae48121a27c05cef828e836f6a3a3cdccf0de78cb7a5bae2838e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\6boxhdun.cmdline
MD5
d8996ce29cd94d8ce11313f51f38e34e

SHA1
04d4e8618c21848055b22f8d61f3e1d672378834

SHA256
8490659d5cedcc8b11a60aaed23978a11a0a49ce508e60f09c0dc90a0c93bd24

SHA512
102419ae9e0c82cdc4be52e9d2ca3d143f0d57604f70725078dd0162971b61667a127b8014fa95df11f16014b0475381a998e4787688f9486efd1ffe30ac522c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC2982.tmp
MD5
346e59b0754ed54125fbb1c982449344

SHA1
26f384f6c429a941763d77c73e5ae7143bef1cfe

SHA256
1777239644df88ad46f50e9c1003a44a41f2f6937b36c4315c9efffd6bf8bc34

SHA512
d60488e42b91ec4408bf59d16b1d04e4c730e700f9c262e9eb228c56c8913443236e036a318e5b8e1381146a1ac06ca510d8e2ad9daca57be1f80247935b2e4e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC2A5C.tmp
MD5
346e59b0754ed54125fbb1c982449344

SHA1
26f384f6c429a941763d77c73e5ae7143bef1cfe

SHA256
1777239644df88ad46f50e9c1003a44a41f2f6937b36c4315c9efffd6bf8bc34

SHA512
d60488e42b91ec4408bf59d16b1d04e4c730e700f9c262e9eb228c56c8913443236e036a318e5b8e1381146a1ac06ca510d8e2ad9daca57be1f80247935b2e4e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC2BD3.tmp
MD5
21f250a1bfce16872af4411d5445ff94

SHA1
e09511640eabf9a4d3686854040e2d430dfee4c1

SHA256
19f6d38254d86fb6632983ba1b8f7c431901d55b0620f36274ea8fdb5ada502f

SHA512
7b3b7d3e3675dc254c10e23155aebbbf275581cf32191ac67f9dd6d417f2968249fe7f381c9c1d1932297dd80b6e2d318fed60a417082aa7dc9ed11c1824744b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC2CAE.tmp
MD5
21f250a1bfce16872af4411d5445ff94

SHA1
e09511640eabf9a4d3686854040e2d430dfee4c1

SHA256
19f6d38254d86fb6632983ba1b8f7c431901d55b0620f36274ea8fdb5ada502f

SHA512
7b3b7d3e3675dc254c10e23155aebbbf275581cf32191ac67f9dd6d417f2968249fe7f381c9c1d1932297dd80b6e2d318fed60a417082aa7dc9ed11c1824744b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC2E64.tmp
MD5
768f89a74b3129cedb05a38d304fd352

SHA1
e2dac7423a19d93b323ce58a193e18c26fb96ff8

SHA256
48f85e6acdd2adfa920645462408b47d13a4b185f71598c51f61aa640a424f8e

SHA512
b6eec912196f562cf521f14289638631b31c9bc830e346316f723b0daf7fb6d69b4309f6cbbd68c946ef4d604ff86f51c96436c77d25232eaee069dbfe1834c8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC2F2F.tmp
MD5
768f89a74b3129cedb05a38d304fd352

SHA1
e2dac7423a19d93b323ce58a193e18c26fb96ff8

SHA256
48f85e6acdd2adfa920645462408b47d13a4b185f71598c51f61aa640a424f8e

SHA512
b6eec912196f562cf521f14289638631b31c9bc830e346316f723b0daf7fb6d69b4309f6cbbd68c946ef4d604ff86f51c96436c77d25232eaee069dbfe1834c8

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC3038.tmp
MD5
94478bcb21b0e0d14703c2870c44aa74

SHA1
2423fe23c73468aa5cd1b269fc28d950e6e48666

SHA256
a0a29b6c4490e90e9e835d323a9e8be574f55a5865976ff0fba5c97e79464261

SHA512
a9cb969c2afb2579b794b39101bc6e3cc6b8fab39d0e5406fe26049e68cc8f1d2d0c3d3cd7d74856ba43d52bca8149789637fca7c3eba2c896f68497dc17f049

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC3104.tmp
MD5
94478bcb21b0e0d14703c2870c44aa74

SHA1
2423fe23c73468aa5cd1b269fc28d950e6e48666

SHA256
a0a29b6c4490e90e9e835d323a9e8be574f55a5865976ff0fba5c97e79464261

SHA512
a9cb969c2afb2579b794b39101bc6e3cc6b8fab39d0e5406fe26049e68cc8f1d2d0c3d3cd7d74856ba43d52bca8149789637fca7c3eba2c896f68497dc17f049

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC3336.tmp
MD5
619d7cd4d21a9d79d0a3b471e7fd798a

SHA1
ae2c3577cbf02f8e550e20b978ba0e62522a6830

SHA256
28c8ebbc8a0982c29d674de21a0d0549cc66dd0a9fef56a813d31d2eb9a6089c

SHA512
193d4fd0b3acff48f76bc80cefeafc36a26d4cc432e3eeeb9b537107e93e264eda135ce37a7e61f7c259becb66ca8c36f7bf06386a81a271f9d52cb711209eaa

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC3440.tmp
MD5
619d7cd4d21a9d79d0a3b471e7fd798a

SHA1
ae2c3577cbf02f8e550e20b978ba0e62522a6830

SHA256
28c8ebbc8a0982c29d674de21a0d0549cc66dd0a9fef56a813d31d2eb9a6089c

SHA512
193d4fd0b3acff48f76bc80cefeafc36a26d4cc432e3eeeb9b537107e93e264eda135ce37a7e61f7c259becb66ca8c36f7bf06386a81a271f9d52cb711209eaa

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC35B7.tmp
MD5
5293ba64d4d82146530c428eadaff7c0

SHA1
af111169a946a5b409fcb60ae0c62771e287a3ef

SHA256
fe7d4fb222cac12577d37c1397846462fc359577e0924e00d599808ea5720241

SHA512
94e1eee1f8c54835a9388235a1ab1162608080168a61ec829e9b33a03be637748f647b42f130c18b012b2e700579c2ade888260ff34045a5f6784d945b748991

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSC7E.tmp
MD5
599d57529d07af185c0f71c7d0337bc5

SHA1
89c7b7829c8528251c20f36e725e43d70a6b66c7

SHA256
fb272864b57170088f3cf05afcb8bf1bd626ffc94cc858ebc2e5f0dd9685ef80

SHA512
057a77f1fd53d70fb4b1d42099a0f455286a9415cb3bcea3f8622356476d29854ac8dd11255d8c7becebb3d1f93463e9fce6112502688b858f9ec33c1d7c4483

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\CSCFF93.tmp
MD5
599d57529d07af185c0f71c7d0337bc5

SHA1
89c7b7829c8528251c20f36e725e43d70a6b66c7

SHA256
fb272864b57170088f3cf05afcb8bf1bd626ffc94cc858ebc2e5f0dd9685ef80

SHA512
057a77f1fd53d70fb4b1d42099a0f455286a9415cb3bcea3f8622356476d29854ac8dd11255d8c7becebb3d1f93463e9fce6112502688b858f9ec33c1d7c4483

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\a91y6vrk.0.cs
MD5
151bdb39748e58856989a5c7305835ee

SHA1
c6fb501d88c5bc7c18898c4c2bfd121440c76dd0

SHA256
fe97688c6bdbee509c826051867775992677ea7b3c0b66038cf3694baea67c10

SHA512
86d97e0ac1f62f0bad92840de52f292096c2859e67072223e11606829ef8853dfd1e7c28edae762a35697797a4c8c7611304300569582692e2314e99e789af50

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\a91y6vrk.cmdline
MD5
91507f836d4fd1f780cfa0964593c6c7

SHA1
a00176b67c05100df2743703929a0e283037ebf3

SHA256
7f0d6d6c55a02a2aa81f271fb2c3ff9e47be2666e37da12b6f58cbeef22a84e4

SHA512
c96bce4e0c37b531263078e84ac554b4cefdad0d365a0cdd96069c2dbaca194e0c764915c48c416a9aa22274877ecae3d0af425490d7e0fb6d9e4193ab65b0f6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\e5df9d0-.0.cs
MD5
121d06510d3acbcab2ad2118363d05ec

SHA1
314fa3fe5bcb68162e65a8de38ec762ef2042b95

SHA256
7e533156e17552387236b75cf67d9c25b20de8cae10a98fe7490430690e35801

SHA512
5e72c9f0cc4476e63d58aa53d85c3be2abcaa768fa38363afea51feaa158f44fb094fd13659e33e6fec8d308107fa58cbe1db123f11559b196c74ba4a7a81584

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\e5df9d0-.cmdline
MD5
6f8f37a8f2f7245c80ad32b433d2ad5c

SHA1
085253ed15696f6a85695a25de3a5e647c1e2742

SHA256
0fa9c5eac69699003d749418cadb2bb402a3c12c59b6df71e8b71fee2f6586b4

SHA512
beb088f40823d8650baab39246ccea6108a28e08fd021b272c046ee7b47aad6c40a4adb7998352e687b91bbfb45e2618e440aac941c16d9a255fc6331da0e5c2

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\efr8ax1f.0.cs
MD5
6be8ad691e3b2475acdab14308e094cd

SHA1
91efaa084a6a4ac23c7859e64f5d35d9f2707452

SHA256
c2305d87d5c6ef9ee424bc7ebb13c07806d3569a7ed0731fbe12b485fc26088c

SHA512
f3eabcb76da1ede77244a9b651aa6d8370e1c6cff8b0f3b692ce87743e07819a66928010bb6d82eddc08a363584fb2dc169c7fedb3c50793969b5b8dbd707f71

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\efr8ax1f.cmdline
MD5
c80c21b115823ce87dd8728fef1fc2c8

SHA1
2622c4fd44996ef7b1fb6e836f5fac7eee465344

SHA256
82d1514dafa5b3066bf10268a8e4bd05a65f361500d3a48ec0243e3403ee0f1b

SHA512
976be2c90ff60be8ba2d337c53ec8f810dfacf4ded077df6b3971395231c2202358695b796df13f1b2b00ba1fad93d04ae09e4ec07b2775616335a959eb53115

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\f_wq2bfb.0.cs
MD5
1b5320084376143dfab6b8d93f6dde82

SHA1
51835770b91a6b459212b2b42ecaf2f8d790fdad

SHA256
0e8225ea9729b1cc65ee946585885ef9976999899d8730ccd087ca2fe418f911

SHA512
ae1e68ff380b16e45122a9266396964e4993cfac0bc8e603a70e2a8a57c42de49261be2d02bf7858ba03f0af2d242c0c99e12a442951ec113e81c0b77d22c06d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\f_wq2bfb.cmdline
MD5
a972545e4e8d12ec871c741cd67d651e

SHA1
8f47a4fa5b2868f3b271ff2adc1c2e482d9d752f

SHA256
c3bc305d1926599c6dee6b713b005e6f300157018b665b59aa24fd67f729f2d4

SHA512
329c4ee7af04afa4921fb8187f519293ef638a40030bb2fe9f2aa6dcd7cf11db275e8dea4b3af9500c5ca687c79c132f1dc69ea9211e2420a3c8bb8e6dcf3ba4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\j5mubrij.0.cs
MD5
27b0d50879603d3c1c8533a9709dff4c

SHA1
1490694a61e06f1536e0968eedb78ba2b73c17be

SHA256
fba524905b5d54950d25af160166f8bc87a8cecf24827825286d3fed7f2fcc2c

SHA512
74b7a9f3f51d33f8ac29a33b22a4897d66787b797a7f340c0f4fdc1909300141a63d3408eac02c744bed134e9d3df056b3cb6dcf2cc62df7a2626eac2176075e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\j5mubrij.cmdline
MD5
2f3662aa9575baec3daf2c2c57d81dfa

SHA1
372cee9ac297542daca3d990e78582578d7f9990

SHA256
d6ace06e9ea6e158b0cacadc4e9d1d3225c8bacd3e7ab9ffcc2668f5ba6fbfd9

SHA512
f73c141b0cd2a314bb012823d25435fee9eea09a18f98cba58af5962f1709651f6c2d41f4c04663246886770a12c2eb79e2cf8d23f4c4931d8d474b6fc06ed41

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kxrqumuc.0.cs
MD5
1ce4ad8242ba618f4cb115437466ef5d

SHA1
7316dc66abc44493a137f6436f778f708e1a5ab4

SHA256
9335fe9cdcfd9068e11cf6ec3df47251e1d092a3de83691acc3464536ff79ec9

SHA512
30780e93a52d0fde85aa82dd71fc369ca4b55cf35e1f4c5dc5b13bd5352a2ad99366b432d0772c34dfc7e1ebd5416ac96e70307dc1071848c652767243a1c361

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\kxrqumuc.cmdline
MD5
d3a8e9727d13c6244e6cc7c4289f41b2

SHA1
a3a32c953329a8fd6543b2bd5c2e7cd4709091eb

SHA256
54e63f8e7b1990661280b3aa1b04ade93fcee507c989b12424f62f0f4c50cd19

SHA512
d81d4c6a70d965b8bea497d33d5dfa9e25253616d0e1fd07351ca5fb670393ea237cb9cb2efd4e436879ec176c4ee5eb2c7d64f2ba4360e82cb2195a120fcf6d

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qnwmjlng.0.cs
MD5
cdcab986ac7435db0a081045e4e57ccd

SHA1
46936607313d870228b956aec1e0bbd4e26bf85d

SHA256
cf61176230f01af3f8250a125fae263a3a8e139cc8a53f0a0cffbfdceba8e911

SHA512
4ce3ca2babf78239e8223a65cb706eb33391d6ae768e23c6931eb51325653b47540af2b60691d0fa65b2d77822c86b3ec369391407f092f50cacb4a3c52d685c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\qnwmjlng.cmdline
MD5
8543f1417309eab30c2a2aed3b1defd1

SHA1
eb7bd194d9b038553be535f001ee0f4f44561978

SHA256
959be917f0d1620e547ff55a44b223d1752deb48abe6c664919ced255c4aa3be

SHA512
9c1285ab611dc826803a94877520a006f808a2c29c74d84df0e871a161f1e7cd92071d1a21ce9ad1eacf49edf1537f5de1061d621104ca121d8ffd6e403f5100

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\waze7oe_.0.cs
MD5
f74db7cacef8c335a00fbbc4a7ac01f6

SHA1
52f35218c5fd768f27816d689e9d5b3702b792f1

SHA256
366d272e229985feca6e26f52ecd7058ae9658b9ecee866d1b762827c27840f6

SHA512
1bf5a6371194c09590e66133fb4003591c204ffc4c6297b83415501258f4b7dcf1f646fc952ce2c5afa6b2a3d462271f8713629c15ed8fb7560dad3c0e9fc877

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\waze7oe_.cmdline
MD5
d75c7043a1bb7536204112c51fff7553

SHA1
1f7a385a70345650660f02f1c92a81de06d67d18

SHA256
407c2a1477c06557ffc01c67c87b1c69ca8456ed5a512d717fa4d32df7227ecd

SHA512
0eafa35bce1b51ae19f44a684d68edc82890d6464ea37e9e408bce014522847391b5e68b22b52371aa0e2e75aa3bc450c8e40a3af5902773f95615faaaa87854

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\x0i5-nka.0.cs
MD5
985be617c3aa818cfc1c6cdcc6294775

SHA1
00a78a5a8a41c64dbcb8e651ac449e932b111118

SHA256
5f4bcf0ddc9ffab4926f3e4c2cbd159adfd6e6a6d603705a68e884d6b5ad5128

SHA512
4b178c8a5b8ecc27266ef528e1d10c1572021688efb202f58d20897911326ae18670f036bbefbccc7aa22d9d8e2c8498ee21d2773d69fac80610e2b2e5554ea6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\x0i5-nka.cmdline
MD5
eebe783e03e9972f36a40690b6395292

SHA1
3fd8e41754fb3ed801f53ff6b51506a3792728a4

SHA256
e4f111c7f1f5139df092eec3cbc461baa801cf4764d53fe5c0bf99cb2ce005be

SHA512
f68c59f8f691fa06bcdcd7b8982ca1ebbedf1d47be0e5cd4f4981115957529b2bc9b3d40740e31ad9ce6cfb775d6ae23ae66094453cd4e5ea0a79654c3601602

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ywj5jkpf.0.cs
MD5
78f802bf2acfebafde40afed8ed4a4ed

SHA1
aa4a82fdbf11d94fcac1586b5e92f684bcc0c7e6

SHA256
9cc8247d3079c449d29cfb07dd4192b43c925e0a92757463d7dde7e4166e7cf9

SHA512
ffd1ea3747876132fdfdef0fa309ce4316d56a26c63f73ca914deaa873304e5e9e1bc1ff646fb8b9fa2ca643b26f238fd760fe36617a19a4c326bb55f3866544

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\ywj5jkpf.cmdline
MD5
e2b4104ea78d1a909b49f69f626d209d

SHA1
181de0942afa53b890ffb384c0f12d96b5bc8146

SHA256
7e565b25f5c817f2e3852c7269346103fc054ef34c9911ed41998876fbf4e7b7

SHA512
577627b64985f9a57303aa39b57d6fb9f91e9f4786c791a24459e3ff6794838ab085533f51ca5403247198ca5cad3e6e10f8f15a6470b678a27802789c2b0d97

Download Submit
memory/188-258-0x0000000000000000-mapping.dmp

Download
memory/188-265-0x00000000023B0000-0x00000000023B2000-memory.dmp

Filesize
8KB

Download
memory/192-166-0x0000000000000000-mapping.dmp

Download
memory/204-236-0x0000000000000000-mapping.dmp

Download
memory/204-279-0x0000000002280000-0x0000000002282000-memory.dmp

Filesize
8KB

Download
memory/208-278-0x00000000023C0000-0x00000000023C2000-memory.dmp

Filesize
8KB

Download
memory/396-173-0x0000000000000000-mapping.dmp

Download
memory/396-290-0x00000000022C0000-0x00000000022C2000-memory.dmp

Filesize
8KB

Download
memory/424-252-0x0000000000000000-mapping.dmp

Download
memory/424-262-0x00000000009B0000-0x00000000009B2000-memory.dmp

Filesize
8KB

Download
memory/504-219-0x0000000000000000-mapping.dmp

Download
memory/512-266-0x0000000000000000-mapping.dmp

Download
memory/512-272-0x0000000000830000-0x0000000000832000-memory.dmp

Filesize
8KB

Download
memory/548-299-0x0000000000860000-0x0000000000862000-memory.dmp

Filesize
8KB

Download
memory/584-259-0x0000000000000000-mapping.dmp

Download
memory/640-303-0x00000000009E0000-0x00000000009E2000-memory.dmp

Filesize
8KB

Download
memory/640-205-0x0000000000000000-mapping.dmp

Download
memory/644-304-0x0000000002050000-0x0000000002052000-memory.dmp

Filesize
8KB

Download
memory/700-302-0x0000000000A50000-0x0000000000A52000-memory.dmp

Filesize
8KB

Download
memory/708-114-0x0000000002AB0000-0x0000000002AB2000-memory.dmp

Filesize
8KB

Download
memory/732-243-0x0000000000000000-mapping.dmp

Download
memory/732-260-0x0000000000980000-0x0000000000982000-memory.dmp

Filesize
8KB

Download
memory/768-254-0x0000000000000000-mapping.dmp

Download
memory/768-263-0x0000000002370000-0x0000000002372000-memory.dmp

Filesize
8KB

Download
memory/780-264-0x0000000000920000-0x0000000000922000-memory.dmp

Filesize
8KB

Download
memory/780-256-0x0000000000000000-mapping.dmp

Download
memory/868-156-0x0000000000000000-mapping.dmp

Download
memory/916-209-0x0000000000000000-mapping.dmp

Download
memory/916-218-0x00000000021F0000-0x00000000021F2000-memory.dmp

Filesize
8KB

Download
memory/948-130-0x0000000002260000-0x0000000002262000-memory.dmp

Filesize
8KB

Download
memory/948-123-0x0000000000000000-mapping.dmp

Download
memory/1172-191-0x00000000024A0000-0x00000000024A2000-memory.dmp

Filesize
8KB

Download
memory/1172-163-0x0000000000000000-mapping.dmp

Download
memory/1184-126-0x0000000000000000-mapping.dmp

Download
memory/1240-301-0x0000000000860000-0x0000000000862000-memory.dmp

Filesize
8KB

Download
memory/1332-297-0x0000000002320000-0x0000000002322000-memory.dmp

Filesize
8KB

Download
memory/1344-242-0x0000000000000000-mapping.dmp

Download
memory/1360-298-0x0000000000900000-0x0000000000902000-memory.dmp

Filesize
8KB

Download
memory/1360-247-0x0000000000A60000-0x0000000000A62000-memory.dmp

Filesize
8KB

Download
memory/1360-239-0x0000000000000000-mapping.dmp

Download
memory/1408-225-0x00000000022C0000-0x00000000022C2000-memory.dmp

Filesize
8KB

Download
memory/1408-170-0x0000000000000000-mapping.dmp

Download
memory/1408-220-0x0000000000000000-mapping.dmp

Download
memory/1408-192-0x0000000000550000-0x0000000000552000-memory.dmp

Filesize
8KB

Download
memory/1448-295-0x00000000009B0000-0x00000000009B2000-memory.dmp

Filesize
8KB

Download
memory/1488-231-0x0000000000000000-mapping.dmp

Download
memory/1496-257-0x0000000000000000-mapping.dmp

Download
memory/1576-248-0x00000000009B0000-0x00000000009B2000-memory.dmp

Filesize
8KB

Download
memory/1576-241-0x0000000000000000-mapping.dmp

Download
memory/1676-215-0x00000000009A0000-0x00000000009A2000-memory.dmp

Filesize
8KB

Download
memory/1676-195-0x0000000000000000-mapping.dmp

Download
memory/1836-255-0x0000000000000000-mapping.dmp

Download
memory/1836-162-0x00000000021E0000-0x00000000021E2000-memory.dmp

Filesize
8KB

Download
memory/1836-153-0x0000000000000000-mapping.dmp

Download
memory/1880-244-0x0000000002480000-0x0000000002482000-memory.dmp

Filesize
8KB

Download
memory/1880-233-0x0000000000000000-mapping.dmp

Download
memory/1900-287-0x0000000002410000-0x0000000002412000-memory.dmp

Filesize
8KB

Download
memory/1900-212-0x0000000000000000-mapping.dmp

Download
memory/1968-280-0x0000000002130000-0x0000000002132000-memory.dmp

Filesize
8KB

Download
memory/2100-300-0x0000000002040000-0x0000000002042000-memory.dmp

Filesize
8KB

Download
memory/2120-245-0x00000000023A0000-0x00000000023A2000-memory.dmp

Filesize
8KB

Download
memory/2120-235-0x0000000000000000-mapping.dmp

Download
memory/2132-180-0x0000000000000000-mapping.dmp

Download
memory/2132-281-0x0000000002440000-0x0000000002442000-memory.dmp

Filesize
8KB

Download
memory/2180-194-0x00000000009E0000-0x00000000009E2000-memory.dmp

Filesize
8KB

Download
memory/2180-184-0x0000000000000000-mapping.dmp

Download
memory/2192-270-0x0000000000000000-mapping.dmp

Download
memory/2192-275-0x0000000000B20000-0x0000000000B22000-memory.dmp

Filesize
8KB

Download
memory/2192-292-0x00000000024A0000-0x00000000024A2000-memory.dmp

Filesize
8KB

Download
memory/2248-223-0x0000000000000000-mapping.dmp

Download
memory/2248-269-0x0000000000000000-mapping.dmp

Download
memory/2252-276-0x0000000002240000-0x0000000002242000-memory.dmp

Filesize
8KB

Download
memory/2264-228-0x0000000000000000-mapping.dmp

Download
memory/2264-277-0x00000000001E0000-0x00000000001E2000-memory.dmp

Filesize
8KB

Download
memory/2268-293-0x00000000004B0000-0x00000000004B2000-memory.dmp

Filesize
8KB

Download
memory/2300-216-0x0000000000000000-mapping.dmp

Download
memory/2300-224-0x0000000002440000-0x0000000002442000-memory.dmp

Filesize
8KB

Download
memory/2304-250-0x0000000000000000-mapping.dmp

Download
memory/2304-284-0x00000000023F0000-0x00000000023F2000-memory.dmp

Filesize
8KB

Download
memory/2304-261-0x0000000002140000-0x0000000002142000-memory.dmp

Filesize
8KB

Download
memory/2312-289-0x0000000002360000-0x0000000002362000-memory.dmp

Filesize
8KB

Download
memory/2324-249-0x0000000000000000-mapping.dmp

Download
memory/2332-227-0x0000000000000000-mapping.dmp

Download
memory/2332-230-0x0000000002000000-0x0000000002002000-memory.dmp

Filesize
8KB

Download
memory/2332-187-0x0000000000000000-mapping.dmp

Download
memory/2376-246-0x00000000023D0000-0x00000000023D2000-memory.dmp

Filesize
8KB

Download
memory/2376-237-0x0000000000000000-mapping.dmp

Download
memory/2376-119-0x0000000000000000-mapping.dmp

Download
memory/2436-274-0x0000000002240000-0x0000000002242000-memory.dmp

Filesize
8KB

Download
memory/2436-268-0x0000000000000000-mapping.dmp

Download
memory/2588-305-0x00000000021E0000-0x00000000021E2000-memory.dmp

Filesize
8KB

Download
memory/2752-296-0x0000000002340000-0x0000000002342000-memory.dmp

Filesize
8KB

Download
memory/2760-253-0x0000000000000000-mapping.dmp

Download
memory/2760-273-0x0000000002320000-0x0000000002322000-memory.dmp

Filesize
8KB

Download
memory/2864-234-0x0000000000000000-mapping.dmp

Download
memory/3020-285-0x0000000002200000-0x0000000002202000-memory.dmp

Filesize
8KB

Download
memory/3040-240-0x0000000000000000-mapping.dmp

Download
memory/3160-294-0x0000000002230000-0x0000000002232000-memory.dmp

Filesize
8KB

Download
memory/3172-193-0x00000000022B0000-0x00000000022B2000-memory.dmp

Filesize
8KB

Download
memory/3172-177-0x0000000000000000-mapping.dmp

Download
memory/3200-149-0x0000000000000000-mapping.dmp

Download
memory/3200-217-0x0000000000570000-0x0000000000572000-memory.dmp

Filesize
8KB

Download
memory/3200-202-0x0000000000000000-mapping.dmp

Download
memory/3256-198-0x0000000000000000-mapping.dmp

Download
memory/3364-115-0x0000000000000000-mapping.dmp

Download
memory/3364-118-0x0000000002200000-0x0000000002202000-memory.dmp

Filesize
8KB

Download
memory/3448-232-0x00000000008C0000-0x00000000008C2000-memory.dmp

Filesize
8KB

Download
memory/3448-229-0x0000000000000000-mapping.dmp

Download
memory/3480-135-0x0000000000000000-mapping.dmp

Download
memory/3480-221-0x0000000000000000-mapping.dmp

Download
memory/3492-251-0x0000000000000000-mapping.dmp

Download
memory/3536-291-0x00000000009B0000-0x00000000009B2000-memory.dmp

Filesize
8KB

Download
memory/3540-271-0x0000000000000000-mapping.dmp

Download
memory/3544-226-0x0000000000980000-0x0000000000982000-memory.dmp

Filesize
8KB

Download
memory/3544-222-0x0000000000000000-mapping.dmp

Download
memory/3544-282-0x0000000000860000-0x0000000000862000-memory.dmp

Filesize
8KB

Download
memory/3628-139-0x0000000000000000-mapping.dmp

Download
memory/3628-160-0x0000000000550000-0x0000000000552000-memory.dmp

Filesize
8KB

Download
memory/3772-283-0x0000000002240000-0x0000000002242000-memory.dmp

Filesize
8KB

Download
memory/3772-131-0x0000000000000000-mapping.dmp

Download
memory/3772-134-0x00000000023D0000-0x00000000023D2000-memory.dmp

Filesize
8KB

Download
memory/3812-267-0x0000000000000000-mapping.dmp

Download
memory/3900-286-0x0000000000AA0000-0x0000000000AA2000-memory.dmp

Filesize
8KB

Download
memory/3904-142-0x0000000000000000-mapping.dmp

Download
memory/4024-238-0x0000000000000000-mapping.dmp

Download
memory/4052-146-0x0000000000000000-mapping.dmp

Download
memory/4052-161-0x0000000000920000-0x0000000000922000-memory.dmp

Filesize
8KB

Download
memory/4068-288-0x00000000001F0000-0x00000000001F2000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads