Overview

overview

10

Static

static

57f332fb42...39.exe

windows7-x64

10

57f332fb42...39.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    53s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 10:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    57f332fb429daaa1d4454e4ab9698beb470a683b8533f9f2176573a6f7e50e39.exe

  • Size

    205KB

  • MD5

    f32fea5e453b0f5704eaf57d7f09566e

  • SHA1

    201108d4180e82b5fe5b357dcc7615bc85f9831a

  • SHA256

    57f332fb429daaa1d4454e4ab9698beb470a683b8533f9f2176573a6f7e50e39

  • SHA512

    d44d7f182709945c6eaf62cb615b1d418511f64948fd9b69923b500715ced5384c33a4d90badace14a5dfc97ab0fb395b4457b23c0ebcfd6a87707ccb0d9b6f3

  • SSDEEP

    3072:dqhMPssRhlARSOsdwD/98out3SDADeak7dJHB/AKG:dqhMPssRARoiSoS3SsQLH5AK

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 11 IoCs
    persistence
  • Modifies system executable filetype association 2 TTPs 13 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 13 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 13 IoCs
    evasion
  • UAC bypass 3 TTPs 11 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 11 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 64 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 11 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 34 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies registry class 58 IoCs
  • Runs ping.exe 1 TTPs 45 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 11 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 22 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\57f332fb429daaa1d4454e4ab9698beb470a683b8533f9f2176573a6f7e50e39.exe
    "C:\Users\Admin\AppData\Local\Temp\57f332fb429daaa1d4454e4ab9698beb470a683b8533f9f2176573a6f7e50e39.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:656
    • C:\Users\Admin\AppData\Local\Temp\57f332fb429daaa1d4454e4ab9698beb470a683b8533f9f2176573a6f7e50e39.exe 
      C:\Users\Admin\AppData\Local\Temp\57f332fb429daaa1d4454e4ab9698beb470a683b8533f9f2176573a6f7e50e39.exe 
      2⤵
      • Modifies WinLogon for persistence
      • Modifies system executable filetype association
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • UAC bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Sets file execution options in registry
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in System32 directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1536
      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1896
        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
          4⤵
          • Modifies WinLogon for persistence
          • Modifies system executable filetype association
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • UAC bypass
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Sets file execution options in registry
          • Loads dropped DLL
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops file in System32 directory
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:948
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
            5⤵
            • Modifies system executable filetype association
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in System32 directory
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1972
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:1836
            • \??\c:\Documents and Settings\Admin\Application Data\Microsoft\wscp.exe
              "c:\Documents and Settings\Admin\Application Data\Microsoft\wscp.exe" csrss
              6⤵
              • Modifies system executable filetype association
              • Modifies visibility of file extensions in Explorer
              • Modifies visiblity of hidden/system files in Explorer
              • Executes dropped EXE
              • Adds Run key to start application
              • Enumerates connected drives
              • Drops file in Program Files directory
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:1980
          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1824
            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
              6⤵
              • Modifies WinLogon for persistence
              • Modifies system executable filetype association
              • Modifies visibility of file extensions in Explorer
              • Modifies visiblity of hidden/system files in Explorer
              • UAC bypass
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Sets file execution options in registry
              • Loads dropped DLL
              • Adds Run key to start application
              • Checks whether UAC is enabled
              • Drops file in System32 directory
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1224
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1556
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:1528
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:432
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:1184
              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in System32 directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1456
                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                  8⤵
                  • Modifies WinLogon for persistence
                  • Modifies system executable filetype association
                  • Modifies visibility of file extensions in Explorer
                  • Modifies visiblity of hidden/system files in Explorer
                  • UAC bypass
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Sets file execution options in registry
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • Checks whether UAC is enabled
                  • Drops file in System32 directory
                  • Modifies Internet Explorer settings
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  • System policy modification
                  PID:1700
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:1992
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetWindowsHookEx
                      PID:1496
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    PID:1104
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetWindowsHookEx
                      PID:1916
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in System32 directory
                    • Suspicious use of SetWindowsHookEx
                    PID:1436
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                      10⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetWindowsHookEx
                      PID:2004
                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of SetWindowsHookEx
                    PID:1748
                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                      10⤵
                      • Modifies WinLogon for persistence
                      • Modifies system executable filetype association
                      • Modifies visibility of file extensions in Explorer
                      • Modifies visiblity of hidden/system files in Explorer
                      • UAC bypass
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Sets file execution options in registry
                      • Loads dropped DLL
                      • Adds Run key to start application
                      • Checks whether UAC is enabled
                      • Drops file in System32 directory
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:1668
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                        11⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetWindowsHookEx
                        PID:1176
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                          12⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetWindowsHookEx
                          PID:1720
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:584
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                          12⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1836
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                        11⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of SetWindowsHookEx
                        PID:340
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                          12⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1968
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1952
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                          12⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:576
                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                        11⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        PID:1124
                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                          12⤵
                          • Modifies WinLogon for persistence
                          • Modifies system executable filetype association
                          • Modifies visibility of file extensions in Explorer
                          • Modifies visiblity of hidden/system files in Explorer
                          • UAC bypass
                          • Disables RegEdit via registry modification
                          • Executes dropped EXE
                          • Sets file execution options in registry
                          • Adds Run key to start application
                          • Checks whether UAC is enabled
                          • Drops file in System32 directory
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:1960
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:748
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                              14⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:1236
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                            13⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Suspicious use of SetWindowsHookEx
                            PID:1556
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                              14⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:560
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                            13⤵
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • Suspicious use of SetWindowsHookEx
                            PID:1140
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                              14⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:1440
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:864
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                              14⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:980
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:2036
                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                              14⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:1992
                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:1904
                          • C:\Windows\SysWOW64\rundll32.exe
                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                            13⤵
                            • Suspicious use of FindShellTrayWindow
                            PID:952
                          • C:\Windows\SysWOW64\ping.exe
                            ping www.duniasex.com -n 65500 -l 1340
                            13⤵
                            • Runs ping.exe
                            PID:2008
                          • C:\Windows\SysWOW64\ping.exe
                            ping www.data0.net -n 65500 -l 1340
                            13⤵
                            • Runs ping.exe
                            PID:1096
                          • C:\Windows\SysWOW64\ping.exe
                            ping www.rasasayang.com.my -n 65500 -l 1210
                            13⤵
                            • Runs ping.exe
                            PID:1068
                          • C:\Windows\SysWOW64\rundll32.exe
                            rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                            13⤵
                              PID:908
                            • C:\Windows\SysWOW64\rundll32.exe
                              rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                              13⤵
                                PID:1604
                              • C:\Windows\SysWOW64\rundll32.exe
                                rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                13⤵
                                  PID:1156
                                • C:\Windows\SysWOW64\rundll32.exe
                                  rundll32.exe taskkill /f /im tati.exe
                                  13⤵
                                    PID:324
                                  • C:\Windows\SysWOW64\rundll32.exe
                                    rundll32.exe taskkill /f /im wscript.exe
                                    13⤵
                                      PID:1556
                                    • C:\Windows\SysWOW64\rundll32.exe
                                      rundll32.exe taskkill /f /im sys.exe
                                      13⤵
                                        PID:768
                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                    11⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1976
                                  • C:\Windows\SysWOW64\rundll32.exe
                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                    11⤵
                                    • Suspicious use of FindShellTrayWindow
                                    PID:1744
                                  • C:\Windows\SysWOW64\ping.exe
                                    ping www.duniasex.com -n 65500 -l 1340
                                    11⤵
                                    • Runs ping.exe
                                    PID:608
                                  • C:\Windows\SysWOW64\ping.exe
                                    ping www.data0.net -n 65500 -l 1340
                                    11⤵
                                    • Runs ping.exe
                                    PID:1660
                                  • C:\Windows\SysWOW64\ping.exe
                                    ping www.rasasayang.com.my -n 65500 -l 1210
                                    11⤵
                                    • Runs ping.exe
                                    PID:976
                                  • C:\Windows\SysWOW64\rundll32.exe
                                    rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                    11⤵
                                      PID:432
                                    • C:\Windows\SysWOW64\rundll32.exe
                                      rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                      11⤵
                                        PID:864
                                      • C:\Windows\SysWOW64\rundll32.exe
                                        rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                        11⤵
                                          PID:2044
                                        • C:\Windows\SysWOW64\rundll32.exe
                                          rundll32.exe taskkill /f /im tati.exe
                                          11⤵
                                            PID:2000
                                          • C:\Windows\SysWOW64\rundll32.exe
                                            rundll32.exe taskkill /f /im wscript.exe
                                            11⤵
                                              PID:1616
                                            • C:\Windows\SysWOW64\rundll32.exe
                                              rundll32.exe taskkill /f /im sys.exe
                                              11⤵
                                                PID:1492
                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                            9⤵
                                              PID:1768
                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                10⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1028
                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                              9⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1904
                                            • C:\Windows\SysWOW64\rundll32.exe
                                              rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                              9⤵
                                              • Suspicious use of FindShellTrayWindow
                                              PID:908
                                            • C:\Windows\SysWOW64\ping.exe
                                              ping www.duniasex.com -n 65500 -l 1340
                                              9⤵
                                              • Runs ping.exe
                                              PID:1820
                                            • C:\Windows\SysWOW64\ping.exe
                                              ping www.data0.net -n 65500 -l 1340
                                              9⤵
                                              • Runs ping.exe
                                              PID:1380
                                            • C:\Windows\SysWOW64\rundll32.exe
                                              rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                              9⤵
                                                PID:924
                                              • C:\Windows\SysWOW64\ping.exe
                                                ping www.rasasayang.com.my -n 65500 -l 1210
                                                9⤵
                                                • Runs ping.exe
                                                PID:1624
                                              • C:\Windows\SysWOW64\rundll32.exe
                                                rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                9⤵
                                                  PID:1912
                                                • C:\Windows\SysWOW64\rundll32.exe
                                                  rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                  9⤵
                                                    PID:1384
                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                    rundll32.exe taskkill /f /im tati.exe
                                                    9⤵
                                                      PID:964
                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                      rundll32.exe taskkill /f /im wscript.exe
                                                      9⤵
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1768
                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                      rundll32.exe taskkill /f /im sys.exe
                                                      9⤵
                                                        PID:1752
                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                    7⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1528
                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                      8⤵
                                                      • Modifies WinLogon for persistence
                                                      • Modifies system executable filetype association
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Modifies visiblity of hidden/system files in Explorer
                                                      • UAC bypass
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Sets file execution options in registry
                                                      • Adds Run key to start application
                                                      • Checks whether UAC is enabled
                                                      • Drops file in System32 directory
                                                      • Modifies Internet Explorer settings
                                                      • Modifies registry class
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:2032
                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                        9⤵
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:892
                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                          10⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1492
                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                        9⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1668
                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                          10⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1220
                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                        9⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:1140
                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                          10⤵
                                                          • Modifies WinLogon for persistence
                                                          • Modifies system executable filetype association
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Modifies visiblity of hidden/system files in Explorer
                                                          • UAC bypass
                                                          • Disables RegEdit via registry modification
                                                          • Executes dropped EXE
                                                          • Sets file execution options in registry
                                                          • Adds Run key to start application
                                                          • Checks whether UAC is enabled
                                                          • Drops file in System32 directory
                                                          • Modifies Internet Explorer settings
                                                          • Modifies registry class
                                                          • Suspicious use of SetWindowsHookEx
                                                          • System policy modification
                                                          PID:292
                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                            11⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:432
                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                              12⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:1440
                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                            11⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1652
                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                              12⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:480
                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                            11⤵
                                                            • Executes dropped EXE
                                                            • Drops file in System32 directory
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1812
                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                              12⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:108
                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                            11⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:468
                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                              12⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:1668
                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                            11⤵
                                                            • Executes dropped EXE
                                                            PID:684
                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                              12⤵
                                                              • Modifies WinLogon for persistence
                                                              • Modifies system executable filetype association
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Modifies visiblity of hidden/system files in Explorer
                                                              • UAC bypass
                                                              • Disables RegEdit via registry modification
                                                              • Sets file execution options in registry
                                                              • Adds Run key to start application
                                                              • Checks whether UAC is enabled
                                                              • Modifies Internet Explorer settings
                                                              • Modifies registry class
                                                              • System policy modification
                                                              PID:972
                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                13⤵
                                                                  PID:1960
                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                    14⤵
                                                                      PID:1768
                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                    13⤵
                                                                    • Drops file in System32 directory
                                                                    PID:480
                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                      14⤵
                                                                        PID:768
                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                      13⤵
                                                                        PID:108
                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                          14⤵
                                                                            PID:340
                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                          13⤵
                                                                          • Drops file in System32 directory
                                                                          PID:1668
                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                            14⤵
                                                                              PID:1948
                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                            13⤵
                                                                              PID:1180
                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                14⤵
                                                                                  PID:2000
                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                13⤵
                                                                                  PID:1904
                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                  rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                  13⤵
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  PID:1464
                                                                                • C:\Windows\SysWOW64\ping.exe
                                                                                  ping www.duniasex.com -n 65500 -l 1340
                                                                                  13⤵
                                                                                  • Runs ping.exe
                                                                                  PID:480
                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                  rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                  13⤵
                                                                                    PID:2092
                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                    rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                    13⤵
                                                                                      PID:2116
                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                      rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                      13⤵
                                                                                        PID:1436
                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                        ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                        13⤵
                                                                                        • Runs ping.exe
                                                                                        PID:1964
                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                        13⤵
                                                                                        • Runs ping.exe
                                                                                        PID:340
                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                        rundll32.exe taskkill /f /im tati.exe
                                                                                        13⤵
                                                                                          PID:2140
                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                          rundll32.exe taskkill /f /im wscript.exe
                                                                                          13⤵
                                                                                            PID:2196
                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                            rundll32.exe taskkill /f /im sys.exe
                                                                                            13⤵
                                                                                              PID:2224
                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                          11⤵
                                                                                          • Drops file in System32 directory
                                                                                          PID:768
                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                          11⤵
                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                          PID:2168
                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                          11⤵
                                                                                          • Runs ping.exe
                                                                                          PID:2300
                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                          ping www.data0.net -n 65500 -l 1340
                                                                                          11⤵
                                                                                          • Runs ping.exe
                                                                                          PID:2324
                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                          ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                          11⤵
                                                                                          • Runs ping.exe
                                                                                          PID:2344
                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                          rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                          11⤵
                                                                                            PID:2360
                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                            rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                            11⤵
                                                                                              PID:2412
                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                              rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                              11⤵
                                                                                                PID:2572
                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                rundll32.exe taskkill /f /im tati.exe
                                                                                                11⤵
                                                                                                  PID:2584
                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                  rundll32.exe taskkill /f /im wscript.exe
                                                                                                  11⤵
                                                                                                    PID:2600
                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                    rundll32.exe taskkill /f /im sys.exe
                                                                                                    11⤵
                                                                                                      PID:2612
                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                  9⤵
                                                                                                    PID:2312
                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                      10⤵
                                                                                                        PID:2424
                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                      9⤵
                                                                                                        PID:2628
                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                          10⤵
                                                                                                            PID:2652
                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                          9⤵
                                                                                                            PID:2732
                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                            9⤵
                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                            PID:2768
                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                                                            9⤵
                                                                                                            • Runs ping.exe
                                                                                                            PID:2860
                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                            ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                            9⤵
                                                                                                            • Runs ping.exe
                                                                                                            PID:2888
                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                            9⤵
                                                                                                            • Runs ping.exe
                                                                                                            PID:2872
                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                            rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                            9⤵
                                                                                                              PID:2920
                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                              rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                              9⤵
                                                                                                                PID:2964
                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                9⤵
                                                                                                                  PID:2992
                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                  rundll32.exe taskkill /f /im tati.exe
                                                                                                                  9⤵
                                                                                                                    PID:3028
                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                    rundll32.exe taskkill /f /im wscript.exe
                                                                                                                    9⤵
                                                                                                                      PID:3060
                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                      rundll32.exe taskkill /f /im sys.exe
                                                                                                                      9⤵
                                                                                                                        PID:108
                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                    7⤵
                                                                                                                    • Drops file in System32 directory
                                                                                                                    PID:2880
                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                                      8⤵
                                                                                                                        PID:3012
                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                      7⤵
                                                                                                                        PID:2140
                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                        7⤵
                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                        PID:1028
                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                                                        7⤵
                                                                                                                        • Runs ping.exe
                                                                                                                        PID:2604
                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                        rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                        7⤵
                                                                                                                          PID:2488
                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                          ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                          7⤵
                                                                                                                          • Runs ping.exe
                                                                                                                          PID:2620
                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                          ping www.duniasex.com -n 65500 -l 1340
                                                                                                                          7⤵
                                                                                                                          • Runs ping.exe
                                                                                                                          PID:2596
                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                          rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                          7⤵
                                                                                                                            PID:2664
                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                            rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                            7⤵
                                                                                                                              PID:2724
                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                              rundll32.exe taskkill /f /im tati.exe
                                                                                                                              7⤵
                                                                                                                                PID:2680
                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                7⤵
                                                                                                                                  PID:2652
                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                  rundll32.exe taskkill /f /im sys.exe
                                                                                                                                  7⤵
                                                                                                                                    PID:2752
                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                5⤵
                                                                                                                                  PID:2504
                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                                                                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                                                                                    6⤵
                                                                                                                                      PID:2544
                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                    5⤵
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    PID:2668
                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                                                      6⤵
                                                                                                                                        PID:2700
                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                      5⤵
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      PID:2744
                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                                                        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                                                        6⤵
                                                                                                                                          PID:2780
                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                        5⤵
                                                                                                                                        • Drops file in System32 directory
                                                                                                                                        PID:3048
                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                        5⤵
                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                        PID:768
                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                        ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                        5⤵
                                                                                                                                        • Runs ping.exe
                                                                                                                                        PID:2376
                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                        ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                        5⤵
                                                                                                                                        • Runs ping.exe
                                                                                                                                        PID:2420
                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                        rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                        5⤵
                                                                                                                                          PID:2456
                                                                                                                                        • C:\Windows\SysWOW64\ping.exe
                                                                                                                                          ping www.data0.net -n 65500 -l 1340
                                                                                                                                          5⤵
                                                                                                                                          • Runs ping.exe
                                                                                                                                          PID:1140
                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                          rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                          5⤵
                                                                                                                                            PID:2416
                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                            rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                            5⤵
                                                                                                                                              PID:2584
                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                              rundll32.exe taskkill /f /im tati.exe
                                                                                                                                              5⤵
                                                                                                                                                PID:2676
                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                                5⤵
                                                                                                                                                  PID:2696
                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                  rundll32.exe taskkill /f /im sys.exe
                                                                                                                                                  5⤵
                                                                                                                                                    PID:2628
                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                3⤵
                                                                                                                                                  PID:108
                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                    4⤵
                                                                                                                                                      PID:1948
                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1152
                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                                                                                                        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                                                                                                        4⤵
                                                                                                                                                          PID:1492
                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1948
                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                                                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                                                                            4⤵
                                                                                                                                                              PID:656
                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                            3⤵
                                                                                                                                                              PID:2244
                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                                                                                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                                                                                4⤵
                                                                                                                                                                • Modifies WinLogon for persistence
                                                                                                                                                                • Modifies system executable filetype association
                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                • UAC bypass
                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                • Sets file execution options in registry
                                                                                                                                                                • Adds Run key to start application
                                                                                                                                                                • Checks whether UAC is enabled
                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                                                • Modifies registry class
                                                                                                                                                                • System policy modification
                                                                                                                                                                PID:2272
                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:2388
                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:2488
                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:2640
                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:2692
                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:2788
                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                                                                                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Modifies WinLogon for persistence
                                                                                                                                                                              • Modifies system executable filetype association
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              • Modifies visiblity of hidden/system files in Explorer
                                                                                                                                                                              • UAC bypass
                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                              • Sets file execution options in registry
                                                                                                                                                                              • Adds Run key to start application
                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                              • System policy modification
                                                                                                                                                                              PID:2828
                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:2932
                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                    8⤵
                                                                                                                                                                                      PID:2060
                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:2200
                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                                        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                                        8⤵
                                                                                                                                                                                          PID:2252
                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                        7⤵
                                                                                                                                                                                          PID:1208
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                                                                                                                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                                                                                                                                            8⤵
                                                                                                                                                                                              PID:864
                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                            7⤵
                                                                                                                                                                                              PID:2132
                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                                                                                                                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                                                                                                                8⤵
                                                                                                                                                                                                  PID:3012
                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                PID:2308
                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                                                                                                                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                    PID:2456
                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:2696
                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                    PID:2392
                                                                                                                                                                                                  • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                    ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                    • Runs ping.exe
                                                                                                                                                                                                    PID:3044
                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                    rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                      PID:2260
                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                      rundll32.exe taskkill /f /im tati.exe
                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                        PID:108
                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                        rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                          PID:2120
                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                          rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                            PID:2276
                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                            ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                            PID:3028
                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                            PID:684
                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                            rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                              PID:2220
                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                              rundll32.exe taskkill /f /im sys.exe
                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                PID:2736
                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                            PID:3028
                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                                                                                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                              PID:3060
                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                  PID:2792
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                    PID:2244
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                        PID:2260
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                                                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                                                          10⤵
                                                                                                                                                                                                                            PID:2556
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                            PID:2676
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                              PID:840
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                  PID:108
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                                                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                      PID:2652
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                    11⤵
                                                                                                                                                                                                                                      PID:2492
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                                                                                        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                                                                                        12⤵
                                                                                                                                                                                                                                          PID:2308
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                          PID:1972
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                                                                                                                                                                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                              PID:2492
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                              PID:3084
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                                                                                                                                                                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                                                                                                                                                                12⤵
                                                                                                                                                                                                                                                  PID:3104
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                  PID:3188
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                                                                                                                                                                    12⤵
                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                    PID:3212
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                        PID:3260
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                            PID:3284
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                            PID:3324
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                                                                                                              14⤵
                                                                                                                                                                                                                                                                PID:3344
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                PID:3388
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                                                                                                                                                                                                                  14⤵
                                                                                                                                                                                                                                                                    PID:3412
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                    PID:3468
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                                                        PID:3492
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                        PID:3572
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                                                                                                                                                                                          C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                                                            PID:3612
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                          13⤵
                                                                                                                                                                                                                                                                            PID:3648
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                            13⤵
                                                                                                                                                                                                                                                                              PID:3668
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                              PID:3760
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                              PID:3752
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                              PID:3736
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                              rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                                                                PID:3816
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                                                                                                                                                                13⤵
                                                                                                                                                                                                                                                                                  PID:3844
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                  rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                                                                    PID:3864
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                    rundll32.exe taskkill /f /im tati.exe
                                                                                                                                                                                                                                                                                    13⤵
                                                                                                                                                                                                                                                                                      PID:3896
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                      rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                                                                        PID:3940
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                        rundll32.exe taskkill /f /im sys.exe
                                                                                                                                                                                                                                                                                        13⤵
                                                                                                                                                                                                                                                                                          PID:3968
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                      11⤵
                                                                                                                                                                                                                                                                                        PID:3744
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                        rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                        11⤵
                                                                                                                                                                                                                                                                                          PID:3912
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                          rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                                                                            PID:3104
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                            ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                                            PID:3172
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                                            PID:3140
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                                            PID:3116
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                            rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                                                                                              PID:3228
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                              rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                                                                                                PID:3364
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                rundll32.exe taskkill /f /im tati.exe
                                                                                                                                                                                                                                                                                                11⤵
                                                                                                                                                                                                                                                                                                  PID:3552
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                PID:3856
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                                                                    PID:4060
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                    PID:3932
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                                                                                                                                                                                                                      10⤵
                                                                                                                                                                                                                                                                                                        PID:3296
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                                                                                                        PID:3992
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                          PID:4032
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                          rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                                                                            PID:4084
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                            rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                              PID:3328
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                              PID:3372
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                              PID:3268
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                              ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                              PID:3356
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                              rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                                                                                                PID:3392
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                  PID:3596
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                  rundll32.exe taskkill /f /im tati.exe
                                                                                                                                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                                                                                                                                    PID:3628
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                PID:3120
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                    PID:3152
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                    PID:3220
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                      PID:3240
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                          PID:3268
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                              PID:3304
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                              PID:3364
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                                                                                                                                                                                C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                                                                                                  PID:3380
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                                                                                                                9⤵
                                                                                                                                                                                                                                                                                                                                  PID:3432
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                                                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe 
                                                                                                                                                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                                                                                                                                                      PID:3448
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                                                                                                                                                      PID:3524
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                                                                                                                                                                                                                                                        C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                                                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                                                                                                                                          PID:3540
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                                                                                        9⤵
                                                                                                                                                                                                                                                                                                                                          PID:3580
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                                                                                                                                                                                                                                                            10⤵
                                                                                                                                                                                                                                                                                                                                              PID:3620
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                                                                                                                                                              PID:3696
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                            PID:3888
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                                                                                                                                                                                                                                                              C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe 
                                                                                                                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                                                                                                                PID:3352
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                                                                                              7⤵
                                                                                                                                                                                                                                                                                                                                                PID:3952
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3280
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3984
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                    rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                                                                                                                      PID:4024
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                      ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                      • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                      PID:3428
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                      rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3488
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                        ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                        PID:3480
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                        ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                        • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                        PID:3416
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                        rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3592
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                          rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                                                                                                                                                                                                                                          7⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3612
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3040
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe 
                                                                                                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3064
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                                            PID:3048
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                            rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                            PID:1900
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                            PID:2144
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                            rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                                                                                                                              PID:3028
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                              ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                              PID:1208
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                              ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                              • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                              PID:864
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                              rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                                                                                                PID:2492
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:2132
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                  rundll32.exe taskkill /f /im tati.exe
                                                                                                                                                                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2664
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                    rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                                                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:3044
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                      rundll32.exe taskkill /f /im sys.exe
                                                                                                                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2500
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\System32\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2992
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                      rundll32.exe C:\Windows\System32\shimgvw.dll, ImageView_Fullscreen
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                      PID:1060
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                      rundll32.exe taskkill /f /im Ansav.exe /im ansavgd.exe
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:2556
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                        rundll32.exe taskkill /f /im kspoold.exe /im kspool.exe
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:2428
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                          rundll32.exe taskkill /f /im PCMAV-CLN.exe /im PCMAV-RTP.exe
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3052
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                            ping www.rasasayang.com.my -n 65500 -l 1210
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                            PID:656
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                            ping www.data0.net -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                            PID:2932
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\ping.exe
                                                                                                                                                                                                                                                                                                                                                                            ping www.duniasex.com -n 65500 -l 1340
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                            • Runs ping.exe
                                                                                                                                                                                                                                                                                                                                                                            PID:2880
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                            rundll32.exe taskkill /f /im tati.exe
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:2592
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                              rundll32.exe taskkill /f /im wscript.exe
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2392
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                                                                                rundll32.exe taskkill /f /im sys.exe
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:2608
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\conhost.exe
                                                                                                                                                                                                                                                                                                                                                                              \??\C:\Windows\system32\conhost.exe "-9359119351894446732-43678971-1185132969-19329172921567084863-20914662661204040702"
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:2612

                                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\57f332fb429daaa1d4454e4ab9698beb470a683b8533f9f2176573a6f7e50e39.exe 
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                129KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                e2c33f1d5b2c10d0fff92ec379577f06

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                db52e7c71eb6e99ad6fa38305a7c62337246cc9e

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\wscp.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                76KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                c1d8e100cbdeb6ab88e27971eb79a6e8

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                bf905c32a1aeb86c44b96669c6e01361e52d93d9

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                e58824ac1dd96e450d54a396b774a0e0ac8b637823b506142089cb312bc977b7

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                e723053f90a919e286525e205d77663f47a18a98661a9ff7159a740a434a177806e02fc019935ed24a7e555da131efe6e6e8771673d14b6614783d637a3986e4

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\MSVBVM60.DLL
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                129KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                e2c33f1d5b2c10d0fff92ec379577f06

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                db52e7c71eb6e99ad6fa38305a7c62337246cc9e

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                129KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                e2c33f1d5b2c10d0fff92ec379577f06

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                db52e7c71eb6e99ad6fa38305a7c62337246cc9e

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                129KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                e2c33f1d5b2c10d0fff92ec379577f06

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                db52e7c71eb6e99ad6fa38305a7c62337246cc9e

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                129KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                e2c33f1d5b2c10d0fff92ec379577f06

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                db52e7c71eb6e99ad6fa38305a7c62337246cc9e

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\services.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                129KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                e2c33f1d5b2c10d0fff92ec379577f06

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                db52e7c71eb6e99ad6fa38305a7c62337246cc9e

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                129KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                e2c33f1d5b2c10d0fff92ec379577f06

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                db52e7c71eb6e99ad6fa38305a7c62337246cc9e

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                129KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                e2c33f1d5b2c10d0fff92ec379577f06

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                db52e7c71eb6e99ad6fa38305a7c62337246cc9e

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\winlogon.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\~Paraysutki_VM_Community~
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \??\c:\Documents and Settings\Admin\Application Data\Microsoft\wscp.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                76KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                c1d8e100cbdeb6ab88e27971eb79a6e8

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                bf905c32a1aeb86c44b96669c6e01361e52d93d9

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                e58824ac1dd96e450d54a396b774a0e0ac8b637823b506142089cb312bc977b7

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                e723053f90a919e286525e205d77663f47a18a98661a9ff7159a740a434a177806e02fc019935ed24a7e555da131efe6e6e8771673d14b6614783d637a3986e4

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\Windows 3D.scr
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                76KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                f58e3844126eb952a4885b601c4cadda

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                16b4ea32cc9f93e9b25199560a28dabd5bdc2796

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                0f03c47d1b6f2d199b7ec18ca7a4df5cbbf56a197c8f8346727c5bdd21073bb8

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                6fee14cc6a16e355d196ca02afad52229bd236713b4ce0aed6f34fc91ab83b395d49d49c3cf0d31f500a20c7964c8e8e648287f5bab207f1bc76b725eaa094a2

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\maxtrox.txt
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                8B

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                24865ca220aa1936cbac0a57685217c5

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\maxtrox.txt
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                8B

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                24865ca220aa1936cbac0a57685217c5

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\maxtrox.txt
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                8B

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                24865ca220aa1936cbac0a57685217c5

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\maxtrox.txt
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                8B

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                24865ca220aa1936cbac0a57685217c5

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\maxtrox.txt
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                8B

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                24865ca220aa1936cbac0a57685217c5

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \??\c:\windows\SysWOW64\maxtrox.txt
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                8B

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                24865ca220aa1936cbac0a57685217c5

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                37f687cafe79e91eae6cbdffbf2f7ad3975f5e83

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                841e95fa333ed89085bfbab19bb658d96ed0c837d25721411233fa55c860c743

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                c8d3f514c72f48fed5de9582c4252cf5466a9d32866d8df3631ba9274ed734bb95139e4909e8116a10947fc1afa1dbeb33809da6ec050e6e4eb83d5241aeb062

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\57f332fb429daaa1d4454e4ab9698beb470a683b8533f9f2176573a6f7e50e39.exe 
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                129KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                e2c33f1d5b2c10d0fff92ec379577f06

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                db52e7c71eb6e99ad6fa38305a7c62337246cc9e

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\57f332fb429daaa1d4454e4ab9698beb470a683b8533f9f2176573a6f7e50e39.exe 
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                129KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                e2c33f1d5b2c10d0fff92ec379577f06

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                db52e7c71eb6e99ad6fa38305a7c62337246cc9e

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Roaming\Microsoft\wscp.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                76KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                c1d8e100cbdeb6ab88e27971eb79a6e8

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                bf905c32a1aeb86c44b96669c6e01361e52d93d9

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                e58824ac1dd96e450d54a396b774a0e0ac8b637823b506142089cb312bc977b7

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                e723053f90a919e286525e205d77663f47a18a98661a9ff7159a740a434a177806e02fc019935ed24a7e555da131efe6e6e8771673d14b6614783d637a3986e4

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Roaming\Microsoft\wscp.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                76KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                c1d8e100cbdeb6ab88e27971eb79a6e8

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                bf905c32a1aeb86c44b96669c6e01361e52d93d9

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                e58824ac1dd96e450d54a396b774a0e0ac8b637823b506142089cb312bc977b7

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                e723053f90a919e286525e205d77663f47a18a98661a9ff7159a740a434a177806e02fc019935ed24a7e555da131efe6e6e8771673d14b6614783d637a3986e4

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                129KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                e2c33f1d5b2c10d0fff92ec379577f06

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                db52e7c71eb6e99ad6fa38305a7c62337246cc9e

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                129KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                e2c33f1d5b2c10d0fff92ec379577f06

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                db52e7c71eb6e99ad6fa38305a7c62337246cc9e

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                129KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                e2c33f1d5b2c10d0fff92ec379577f06

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                db52e7c71eb6e99ad6fa38305a7c62337246cc9e

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\csrss.exe 
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                129KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                e2c33f1d5b2c10d0fff92ec379577f06

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                db52e7c71eb6e99ad6fa38305a7c62337246cc9e

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\lsass.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\msvbvm60.dll
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                1.3MB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                205KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                5566cf6b1e7a9c92c018497dbf2fb3fa

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                e81ee0ff7634b7fe47e379439834d16acc675d09

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                cc762d5316da1be9deef71d11c9a1f54872b745e56f18e6a3a096d1b7399b325

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                a9e2ce93bbb769c4ac630ea88ea15c73d19018e45fac64b805843f6d6326fba5e04b59164dc1e5d9905695cc480918a6c41ce0c8fdf4211cfc513af255eb3cc7

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                129KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                e2c33f1d5b2c10d0fff92ec379577f06

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                db52e7c71eb6e99ad6fa38305a7c62337246cc9e

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                129KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                e2c33f1d5b2c10d0fff92ec379577f06

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                db52e7c71eb6e99ad6fa38305a7c62337246cc9e

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\~A~m~B~u~R~a~D~u~L~²\smss.exe 
                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                129KB

                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                e2c33f1d5b2c10d0fff92ec379577f06

                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                db52e7c71eb6e99ad6fa38305a7c62337246cc9e

                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                6fe9ec72f717f7e26398412b782a725030c796a253d3d17c883a6dbaf1bc4e01

                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                6a813184d730de5a8d2295222c4a47a7295e28886c5a982ab9d94a7ceed7f41683038ce9981fa1a789a8371095807fe4b36ae3f3502588624fed94664aa6b1c8

                                                                                                                                                                                                                                                                                                                                                                                Download Submit

                                                                                                                                                                                                                                                                                                                                                                              • memory/292-360-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/324-299-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/340-217-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/432-305-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/432-149-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/480-365-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/560-250-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/560-247-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/576-230-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/576-227-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/584-210-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/608-296-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/656-430-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/656-75-0x0000000000230000-0x000000000025A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/656-78-0x0000000000230000-0x000000000025A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/748-237-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/768-387-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/768-309-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/864-261-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/864-541-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/864-312-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/908-288-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/948-139-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/948-525-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/948-74-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/952-279-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/972-402-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/972-431-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/976-302-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/980-264-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/980-267-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1028-306-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1068-286-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1096-285-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1104-180-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1124-231-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1124-257-0x0000000000320000-0x000000000034A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1140-358-0x00000000001C0000-0x00000000001EA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1140-251-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1156-294-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1176-204-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1180-401-0x0000000000270000-0x000000000029A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1184-157-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1184-162-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1208-540-0x0000000000230000-0x000000000025A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1224-124-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1224-143-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1236-243-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1236-240-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1436-187-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1440-254-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1440-260-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1440-259-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1440-357-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1456-165-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1456-200-0x0000000000310000-0x000000000033A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1492-342-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1492-415-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1496-176-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1496-179-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1528-356-0x0000000000350000-0x000000000037A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1528-355-0x0000000000350000-0x000000000037A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1528-138-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1528-146-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1536-58-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1536-80-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1556-244-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1556-131-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1556-304-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1604-292-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1660-300-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1668-197-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1668-203-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1668-374-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1700-339-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1700-170-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1700-201-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1720-207-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1744-289-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1748-194-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1748-202-0x0000000000260000-0x000000000028A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1768-315-0x00000000003C0000-0x00000000003EA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1768-297-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1824-142-0x0000000000330000-0x000000000035A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1824-116-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1836-98-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1836-213-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1836-216-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1836-103-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1896-82-0x0000000000250000-0x000000000027A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1896-64-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1904-275-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1904-318-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1916-183-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1916-186-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1948-396-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1952-224-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1960-278-0x0000000075131000-0x0000000075133000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                8KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1960-258-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1960-234-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1960-320-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1968-220-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1968-223-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1972-114-0x0000000000230000-0x0000000000236000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                24KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1972-90-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1976-281-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1980-106-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1992-271-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1992-173-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/1992-274-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/2004-190-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/2004-193-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/2008-283-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/2032-359-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/2036-268-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/2044-316-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/2060-504-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/2200-526-0x0000000000230000-0x000000000025A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/2244-447-0x0000000000230000-0x000000000025A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/2252-515-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/2272-449-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/2424-450-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/2488-452-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/2544-459-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/2544-453-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/2652-470-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/2692-473-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/2828-488-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                                                                              • memory/3012-503-0x0000000000400000-0x000000000042A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                168KB

                                                                                                                                                                                                                                                                                                                                                                                Download