hxxps://github[.]com/MalwareStudio?tab=repositories

Analysis

max time kernel
481s
max time network
900s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
18-05-2024 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/MalwareStudio?tab=repositories

Score

8^/10

discovery exploit persistence

Malware Config

Signatures

Downloads MZ/PE file
Possible privilege escalation attempt 3 IoCs
exploit

Processes:

takeown.exetakeown.exeicacls.exe

pid process

15512 takeown.exe
9092 takeown.exe
9108 icacls.exe
Executes dropped EXE 3 IoCs

Processes:

Teletubisie Setup.exeTeletubisie Setup.exeBonzify.exe

pid process

1416 Teletubisie Setup.exe
8204 Teletubisie Setup.exe
8484 Bonzify.exe
Modifies file permissions 1 TTPs 3 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exe

pid process

9092 takeown.exe
9108 icacls.exe
15512 takeown.exe

pid	process
15512	takeown.exe
9092	takeown.exe
9108	icacls.exe

pid	process
1416	Teletubisie Setup.exe
8204	Teletubisie Setup.exe
8484	Bonzify.exe

pid	process
9092	takeown.exe
9108	icacls.exe
15512	takeown.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bsodhta = "mshta c:\\windows\\startshell.hta"	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

Processes:

flow	ioc
298	raw.githubusercontent.com
313	raw.githubusercontent.com
121	raw.githubusercontent.com
122	raw.githubusercontent.com
237	raw.githubusercontent.com
240	raw.githubusercontent.com

Drops file in System32 directory 1 IoCs

Processes:

cmd.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\icuin.dll cmd.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\icuin.dll	cmd.exe

Drops file in Program Files directory 6 IoCs

Processes:

Teletubisie Setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Teletubisie\teletubisie.$$A	Teletubisie Setup.exe
File opened for modification	C:\Program Files (x86)\Teletubisie\Uninstal.exe	Teletubisie Setup.exe
File created	C:\Program Files (x86)\Teletubisie\Uninstal.$$A	Teletubisie Setup.exe
File created	C:\Program Files (x86)\Teletubisie\1.$$A	Teletubisie Setup.exe
File created	C:\Program Files (x86)\Teletubisie\killer.$$A	Teletubisie Setup.exe
File created	C:\Program Files (x86)\Teletubisie\matrix.$$A	Teletubisie Setup.exe

Drops file in Windows directory 5 IoCs

Processes:

taskmgr.execmd.exeBonzify.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe
File created	\??\c:\windows\startshell.hta	cmd.exe
File opened for modification	\??\c:\windows\startshell.hta	cmd.exe
File created	C:\Windows\executables.bin	Bonzify.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 46 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3416	4800	WerFault.exe	WScript.exe
3496	13792	WerFault.exe	WScript.exe
1476	3148	WerFault.exe	WScript.exe
7452	6604	WerFault.exe	WScript.exe
6572	8508	WerFault.exe	WScript.exe
13220	5072	WerFault.exe	WScript.exe
8128	13704	WerFault.exe	WScript.exe
9656	9616	WerFault.exe	WScript.exe
5704	9236	WerFault.exe	WScript.exe
9368	10232	WerFault.exe	WScript.exe
13924	13704	WerFault.exe	WScript.exe
1756	10232	WerFault.exe	WScript.exe
6396	4316	WerFault.exe	powershell_ise.exe
13016	14008	WerFault.exe	WScript.exe
8780	1756	WerFault.exe	WerFault.exe
8272	11444	WerFault.exe	WScript.exe
4456	2956	WerFault.exe	WScript.exe
14904	14704	WerFault.exe	IMJPDCT.EXE
15052	15352	WerFault.exe	WScript.exe
11368	8044	WerFault.exe	WScript.exe
4560	14008	WerFault.exe	WScript.exe
11604	11368	WerFault.exe	WerFault.exe
13076	15096	WerFault.exe	WScript.exe
12040	15352	WerFault.exe	WScript.exe
15220	8044	WerFault.exe	WScript.exe
4808	15096	WerFault.exe	WScript.exe
14984	14776	WerFault.exe	WScript.exe
12676	13220	WerFault.exe	WerFault.exe
15100	3076	WerFault.exe	WScript.exe
15336	13400	WerFault.exe	SystemPropertiesAdvanced.exe
15264	8900	WerFault.exe	WScript.exe
5212	14732	WerFault.exe	WScript.exe
14032	14388	WerFault.exe	WScript.exe
15452	11972	WerFault.exe	WScript.exe
12940	15836	WerFault.exe	wmplayer.exe
7740	13400	WerFault.exe	SystemPropertiesAdvanced.exe
16036	14732	WerFault.exe	WScript.exe
3592	15892	WerFault.exe	WScript.exe
5196	1864	WerFault.exe	WScript.exe
9368	15716	WerFault.exe	cscript.exe
5660	16068	WerFault.exe	WScript.exe
13172	11180	WerFault.exe	msinfo32.exe
15604	5072	WerFault.exe	WScript.exe
10128	5660	WerFault.exe	WerFault.exe
8208	16068	WerFault.exe	WScript.exe
6328	8208	WerFault.exe	WerFault.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

14528 tasklist.exe

pid	process
14528	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exe

pid process

15140 ipconfig.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

8684 taskkill.exe

pid	process
15140	ipconfig.exe

pid	process
8684	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133605134000319663"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

Processes:

chrome.execmd.execmd.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.lnk\ = "death12922"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1728 reg.exe
Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4984 PING.EXE

pid	process
1728	reg.exe

pid	process
4984	PING.EXE

Suspicious behavior: EnumeratesProcesses 32 IoCs

Processes:

chrome.exechrome.exetaskmgr.exe

pid	process
4384	chrome.exe
4384	chrome.exe
4348	chrome.exe
4348	chrome.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

cmd.exe

pid process

4000 cmd.exe

pid	process
4000	cmd.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

Processes:

chrome.exe

pid	process
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe
Token: SeShutdownPrivilege	4384	chrome.exe
Token: SeCreatePagefilePrivilege	4384	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe

pid	process
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe

Suspicious use of SendNotifyMessage 55 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
4384	chrome.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe
9756	taskmgr.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

Teletubisie Setup.exeTeletubisie Setup.exeBonzify.exe

pid process

1416 Teletubisie Setup.exe
8204 Teletubisie Setup.exe
8484 Bonzify.exe

pid	process
1416	Teletubisie Setup.exe
8204	Teletubisie Setup.exe
8484	Bonzify.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4384 wrote to memory of 2288	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2288	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2776	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2148	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 2148	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe
PID 4384 wrote to memory of 4824	4384	chrome.exe	chrome.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

14460 attrib.exe

pid	process
14460	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/MalwareStudio?tab=repositories
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4384

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff96b999758,0x7ff96b999768,0x7ff96b999778
2⤵
PID:2288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:2
2⤵
PID:2776

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1812 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:2148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2068 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:4824

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2820 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:1
2⤵
PID:1356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2828 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:1
2⤵
PID:3308

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4428 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:2072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4440 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4648 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4348

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1484 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:1
2⤵
PID:4268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5044 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:1
2⤵
PID:3448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4984 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:1412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5140 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:4180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1572 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:1
2⤵
PID:4408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4864 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:1
2⤵
PID:1616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3812 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:4616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3820 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:1
2⤵
PID:4376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:2896

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:3452

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5908 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:2712

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5968 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:1124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6168 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:3572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6200 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:2512

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2932 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=5444 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:1
2⤵
PID:2648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6520 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:4428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5404 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:1
2⤵
PID:4724

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6536 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:1
2⤵
PID:368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=6716 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:1
2⤵
PID:4628

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=6748 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:1
2⤵
PID:2868

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=6944 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:1
2⤵
PID:5024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4876 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:3584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5500 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:4476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4368 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:5064

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4672 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:2240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4904 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:4884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2956 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:1704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:1400

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\avast.vbs"
2⤵
PID:2120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6212 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:2064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\bluelogon.bat" "
2⤵
- Drops file in Windows directory
- Modifies registry class
PID:4480

C:\Windows\system32\wscript.exe
wscript x.vbs
3⤵
PID:3372

C:\Windows\system32\PING.EXE
ping localhost -n 1
3⤵
- Runs ping.exe
PID:4984

C:\Windows\system32\reg.exe
reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v bsodhta /d "mshta c:\windows\startshell.hta" /f
3⤵
- Adds Run key to start application
- Modifies registry key
PID:1728

C:\Windows\system32\reg.exe
reg import nokeyboard.reg
3⤵
PID:3568

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7112 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:3576

C:\Users\Admin\Downloads\Teletubisie Setup.exe
"C:\Users\Admin\Downloads\Teletubisie Setup.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1416

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Teletubisie\teletubisie.bat""
3⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:4000

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K killer.bat
4⤵
- Drops file in System32 directory
PID:2160

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:4448

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:1000

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:2804

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:4236

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:648

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:1624

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:636

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:4528

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:2276

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:4320

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:64

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:3860

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:4336

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:656

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:2840

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:4452

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:3020

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:4192

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:5048

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:2908

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:4028

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:3912

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:3516

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:4760

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:3984

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:1612

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:1064

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:1432

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:4940

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:2600

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:4088

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:1332

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:5148

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:5204

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:5236

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:5284

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:5316

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:5328

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:5400

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:5412

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:5464

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:5480

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:5544

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:5564

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:5612

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:5624

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:5712

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:5780

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:5812

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:5824

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:5856

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:5932

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:5972

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:5984

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6060

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6072

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6140

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:600

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:5448

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:5580

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:3036

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6056

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6168

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6208

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6236

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6284

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6328

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6340

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6384

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6400

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6476

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6484

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6540

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6556

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6592

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6612

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6712

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6720

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6788

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6820

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6852

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6860

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6932

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6940

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6976

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6988

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7060

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7072

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7136

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6320

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6580

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7020

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7172

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7196

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7264

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7272

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7316

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7352

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7496

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7504

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7572

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7584

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7608

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7672

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7708

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7748

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7800

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7832

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7876

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7908

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7940

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7980

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:8012

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8056

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:8088

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8104

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:8144

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8172

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7760

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8068

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:8244

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8252

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:8312

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8348

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:8380

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8396

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:8472

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8596

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:8652

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8700

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:8736

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8760

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:8804

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8812

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:8980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:9020

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:9052

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:9140

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:9180

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:9188

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:8360

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8468

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:9032

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:9124

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:9092

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8692

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:9112

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:9280

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:9332

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:9340

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:9408

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:9416

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:9496

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:9524

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:9604

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:9632

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:9680

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:9708

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:9844

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:9864

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:9952

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:9960

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:10016

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:10024

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:10056

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:10072

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:10176

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:10208

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:10224

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:2468

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:10284

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:10348

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:10508

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:10568

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:10640

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:10704

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:10812

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:10876

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:10984

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11032

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11156

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11168

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11228

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:5672

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:4296

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11144

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11272

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11288

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11324

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11332

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11480

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11524

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11556

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11612

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11728

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11736

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11776

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11800

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11840

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11908

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11948

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11960

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12084

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:12132

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12172

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:12196

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12272

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:12400

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12736

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:12844

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12928

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:12944

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13028

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:13056

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13120

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:13144

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13184

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:13240

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12260

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:12148

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12304

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:12352

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12424

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8044

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12776

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:12780

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12716

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:13052

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13156

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:12648

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12684

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:12552

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12616

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:12660

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12708

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:12360

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13316

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:13376

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13460

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:13472

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13512

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:13604

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13668

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:13676

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13820

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:13856

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13904

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:13912

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13964

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:14020

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:14104

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:14112

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:14180

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:14224

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:14260

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:14324

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:1408

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:3408

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:1140

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:776

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:1760

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:4732

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13696

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:13744

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13952

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:5892

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6080

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6100

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:3148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 652
5⤵
- Program crash
PID:1476

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6088

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6604 -s 652
5⤵
- Program crash
PID:7452

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6608

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13792 -s 652
5⤵
- Program crash
PID:3496

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7112

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:4800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4800 -s 656
5⤵
- Program crash
PID:3416

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6816

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7868

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:3988

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:8508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8508 -s 652
5⤵
- Program crash
PID:6572

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:12224

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7156

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6836

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:8756

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7028

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 652
5⤵
- Program crash
PID:13220

C:\Windows\SysWOW64\F12\F12Chooser.exe
"C:\Windows\SysWOW64\F12\F12Chooser.exe"
6⤵
PID:6020

C:\Windows\WinSxS\amd64_netfx4-addinutil_b03f5f7f11d50a3a_4.0.15552.17062_none_cd46a3e1e2aeb3d2\AddInUtil.exe
"C:\Windows\WinSxS\amd64_netfx4-addinutil_b03f5f7f11d50a3a_4.0.15552.17062_none_cd46a3e1e2aeb3d2\AddInUtil.exe"
6⤵
PID:13636

C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.15063.0_none_8b5bac6f93becfcc\DpiScaling.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-dpiscaling_31bf3856ad364e35_10.0.15063.0_none_8b5bac6f93becfcc\DpiScaling.exe"
6⤵
PID:14056

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" ms-settings:display
7⤵
PID:12316

C:\Windows\WinSxS\amd64_microsoft-windows-p..spaces-creator-tool_31bf3856ad364e35_10.0.15063.0_none_806743e6508512ad\pwcreator.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-p..spaces-creator-tool_31bf3856ad364e35_10.0.15063.0_none_806743e6508512ad\pwcreator.exe"
6⤵
PID:5888

C:\Windows\SysWOW64\w32tm.exe
"C:\Windows\SysWOW64\w32tm.exe"
6⤵
PID:14176

C:\Windows\System32\w32tm.exe
"C:\Windows\SysWOW64\w32tm.exe"
7⤵
PID:10584

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\System32\msiexec.exe"
6⤵
PID:11076

C:\Windows\WinSxS\x86_jsc_b03f5f7f11d50a3a_4.0.15552.17062_none_b7205562ffbc3d7e\jsc.exe
"C:\Windows\WinSxS\x86_jsc_b03f5f7f11d50a3a_4.0.15552.17062_none_b7205562ffbc3d7e\jsc.exe"
6⤵
PID:5924

C:\Windows\SysWOW64\CameraSettingsUIHost.exe
"C:\Windows\System32\CameraSettingsUIHost.exe"
6⤵
PID:10104

C:\Windows\SysWOW64\ieUnatt.exe
"C:\Windows\System32\ieUnatt.exe"
6⤵
PID:13324

C:\Windows\WinSxS\x86_microsoft-windows-systray_31bf3856ad364e35_10.0.15063.0_none_a846ba88767b5b8f\systray.exe
"C:\Windows\WinSxS\x86_microsoft-windows-systray_31bf3856ad364e35_10.0.15063.0_none_a846ba88767b5b8f\systray.exe"
6⤵
PID:13880

C:\Windows\WinSxS\msil_dfsvc_b03f5f7f11d50a3a_10.0.15063.0_none_1f1dd9002563ae1d\dfsvc.exe
"C:\Windows\WinSxS\msil_dfsvc_b03f5f7f11d50a3a_10.0.15063.0_none_1f1dd9002563ae1d\dfsvc.exe"
6⤵
PID:14644

C:\Windows\WinSxS\amd64_wpf-presentationfontcache_31bf3856ad364e35_10.0.15063.0_none_16ad70084afccb22\PresentationFontCache.exe
"C:\Windows\WinSxS\amd64_wpf-presentationfontcache_31bf3856ad364e35_10.0.15063.0_none_16ad70084afccb22\PresentationFontCache.exe"
6⤵
PID:15020

C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.15063.0_none_c3a1f3eac5033978\attrib.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.15063.0_none_c3a1f3eac5033978\attrib.exe"
6⤵
- Views/modifies file attributes
PID:14460

C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.15063.0_none_1c7d9c5887e872fd\wmpshare.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.15063.0_none_1c7d9c5887e872fd\wmpshare.exe"
6⤵
PID:9972

C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.15063.0_none_be146ab6516b9494\wusa.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-wusa_31bf3856ad364e35_10.0.15063.0_none_be146ab6516b9494\wusa.exe"
6⤵
PID:8860

C:\Windows\WinSxS\amd64_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.15063.0_none_68208ee220d71dc1\LinqWebConfig.exe
"C:\Windows\WinSxS\amd64_netfx35linq-linqwebconfig_31bf3856ad364e35_10.0.15063.0_none_68208ee220d71dc1\LinqWebConfig.exe"
6⤵
PID:13828

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe"
6⤵
PID:8232

C:\Windows\WinSxS\x86_microsoft-windows-credwiz_31bf3856ad364e35_10.0.15063.0_none_54cfee60ec4666ba\credwiz.exe
"C:\Windows\WinSxS\x86_microsoft-windows-credwiz_31bf3856ad364e35_10.0.15063.0_none_54cfee60ec4666ba\credwiz.exe"
6⤵
PID:15208

C:\Windows\WinSxS\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_10.0.15063.0_none_5ed4a96b3e219375\RelPost.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-reliability-postboot_31bf3856ad364e35_10.0.15063.0_none_5ed4a96b3e219375\RelPost.exe"
6⤵
PID:14376

C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.15063.0_none_a0561a8759977fdf\wkspbroker.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.15063.0_none_a0561a8759977fdf\wkspbroker.exe"
6⤵
PID:15300

C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe
"C:\Windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe"
6⤵
PID:14008

C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.15063.0_none_c35e08076ddb1808\LicenseManagerShellext.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-s..nsemanager-shellext_31bf3856ad364e35_10.0.15063.0_none_c35e08076ddb1808\LicenseManagerShellext.exe"
6⤵
PID:2308

C:\Windows\SysWOW64\ComputerDefaults.exe
"C:\Windows\SysWOW64\ComputerDefaults.exe"
6⤵
PID:5280

C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.15063.0_none_bc611a88528e688d\fixmapi.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.15063.0_none_bc611a88528e688d\fixmapi.exe"
6⤵
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13220 -s 2524
6⤵
- Program crash
PID:12676

C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe
"C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe"
6⤵
PID:12576

C:\Windows\SysWOW64\efsui.exe
"C:\Windows\SysWOW64\efsui.exe"
7⤵
PID:14912

C:\Windows\WinSxS\wow64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.15063.0_none_767a268eea91c3f3\rdrleakdiag.exe
"C:\Windows\WinSxS\wow64_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_10.0.15063.0_none_767a268eea91c3f3\rdrleakdiag.exe"
6⤵
PID:4132

C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe"
6⤵
PID:16168

C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.15063.0_none_5a954e05bee89c0d\msiexec.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-installer-executable_31bf3856ad364e35_10.0.15063.0_none_5a954e05bee89c0d\msiexec.exe"
6⤵
PID:16376

C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.15063.0_none_5e256a3b453ac566\bitsadmin.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-bits-bitsadmin_31bf3856ad364e35_10.0.15063.0_none_5e256a3b453ac566\bitsadmin.exe"
6⤵
PID:15916

C:\Windows\SysWOW64\unlodctr.exe
"C:\Windows\SysWOW64\unlodctr.exe"
6⤵
PID:14340

C:\Windows\SysWOW64\winver.exe
"C:\Windows\System32\winver.exe"
6⤵
PID:14748

C:\Windows\SysWOW64\odbcconf.exe
"C:\Windows\System32\odbcconf.exe"
6⤵
PID:3000

C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.15063.0_none_cc104740b5680cc1\dcomcnfg.exe
"C:\Windows\WinSxS\wow64_microsoft-windows-com-complus-ui_31bf3856ad364e35_10.0.15063.0_none_cc104740b5680cc1\dcomcnfg.exe"
6⤵
PID:3880

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe C:\Windows\system32\comexp.msc
7⤵
PID:14612

C:\Windows\SysWOW64\msinfo32.exe
"C:\Windows\System32\msinfo32.exe"
6⤵
PID:11180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 11180 -s 768
7⤵
- Program crash
PID:13172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5072 -s 652
5⤵
- Program crash
PID:15604

C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.15063.0_none_d123dd2c727d3948\svchost.exe
"C:\Windows\WinSxS\wow64_microsoft-windows-services-svchost_31bf3856ad364e35_10.0.15063.0_none_d123dd2c727d3948\svchost.exe"
6⤵
PID:7376

C:\Windows\WinSxS\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.15063.0_none_1618b8867f46668a\logman.exe
"C:\Windows\WinSxS\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.15063.0_none_1618b8867f46668a\logman.exe"
6⤵
PID:8680

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
6⤵
PID:9080

C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.15063.0_none_e819281ea9bc03bf\AxInstUI.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-axinstallservice_31bf3856ad364e35_10.0.15063.0_none_e819281ea9bc03bf\AxInstUI.exe"
6⤵
PID:8244

C:\Windows\SysWOW64\ReAgentc.exe
"C:\Windows\System32\ReAgentc.exe"
6⤵
PID:4568

C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.15063.0_none_be3772f6b91825d9\FXSUNATD.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-fax-service_31bf3856ad364e35_10.0.15063.0_none_be3772f6b91825d9\FXSUNATD.exe"
6⤵
PID:12736

C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.15063.0_none_0eff3a7dfbd65b7a\CertEnrollCtrl.exe
"C:\Windows\WinSxS\wow64_microsoft-windows-x..rtificateenrollment_31bf3856ad364e35_10.0.15063.0_none_0eff3a7dfbd65b7a\CertEnrollCtrl.exe"
6⤵
PID:8080

C:\Windows\SysWOW64\typeperf.exe
"C:\Windows\System32\typeperf.exe"
7⤵
PID:13536

C:\Windows\WinSxS\wow64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.15063.0_none_9b4bb01690591548\SettingSyncHost.exe
"C:\Windows\WinSxS\wow64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.15063.0_none_9b4bb01690591548\SettingSyncHost.exe"
6⤵
PID:5352

C:\Windows\SysWOW64\cttunesvr.exe
"C:\Windows\System32\cttunesvr.exe"
6⤵
PID:9888

C:\Windows\SysWOW64\printui.exe
"C:\Windows\System32\printui.exe"
6⤵
PID:7160

C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.15063.0_none_f4f5cf31388ea241\wbengine.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-blb-engine-main_31bf3856ad364e35_10.0.15063.0_none_f4f5cf31388ea241\wbengine.exe"
6⤵
PID:11260

C:\Windows\SysWOW64\systray.exe
"C:\Windows\SysWOW64\systray.exe"
6⤵
PID:14808

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
6⤵
PID:6052

C:\Windows\WinSxS\amd64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.15063.0_none_29d654d1c0932f30\chkntfs.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-autochkconfigurator_31bf3856ad364e35_10.0.15063.0_none_29d654d1c0932f30\chkntfs.exe"
6⤵
PID:9856

C:\Windows\SysWOW64\PkgMgr.exe
"C:\Windows\SysWOW64\PkgMgr.exe"
6⤵
PID:15192

C:\Windows\WinSxS\amd64_windows-application..haringsvc-ntservice_31bf3856ad364e35_10.0.15063.0_none_ddaf2db073e6652b\dstokenclean.exe
"C:\Windows\WinSxS\amd64_windows-application..haringsvc-ntservice_31bf3856ad364e35_10.0.15063.0_none_ddaf2db073e6652b\dstokenclean.exe"
7⤵
PID:10720

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersServer.exe"
6⤵
PID:15556

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:9168

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13704 -s 656
5⤵
- Program crash
PID:8128

C:\Windows\WinSxS\amd64_microsoft-windows-recover_31bf3856ad364e35_10.0.15063.0_none_97272707ed69b8da\recover.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-recover_31bf3856ad364e35_10.0.15063.0_none_97272707ed69b8da\recover.exe"
6⤵
PID:9504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13704 -s 656
5⤵
- Program crash
PID:13924

C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.15063.0_none_b47e9249fd746ecc\dfrgui.exe
"C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.15063.0_none_b47e9249fd746ecc\dfrgui.exe"
6⤵
PID:4800

C:\Windows\SysWOW64\WSManHTTPConfig.exe
"C:\Windows\System32\WSManHTTPConfig.exe"
6⤵
PID:11608

C:\Windows\SysWOW64\MRINFO.EXE
"C:\Windows\SysWOW64\MRINFO.EXE"
6⤵
PID:14036

C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.15063.0_none_e661adada9f803d0\ReAgentc.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-winre-recoverytools_31bf3856ad364e35_10.0.15063.0_none_e661adada9f803d0\ReAgentc.exe"
6⤵
PID:4420

C:\Windows\WinSxS\amd64_netfx-ieexec_b03f5f7f11d50a3a_10.0.15063.0_none_62c5d8cc15957bd9\IEExec.exe
"C:\Windows\WinSxS\amd64_netfx-ieexec_b03f5f7f11d50a3a_10.0.15063.0_none_62c5d8cc15957bd9\IEExec.exe"
6⤵
PID:4312

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 640
7⤵
PID:14072

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7296

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:9616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9616 -s 656
5⤵
- Program crash
PID:9656

C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_10.0.15063.0_none_e3081a9148d3fced\repair-bde.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-s..restartup-repairbde_31bf3856ad364e35_10.0.15063.0_none_e3081a9148d3fced\repair-bde.exe"
6⤵
PID:13340

C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.15063.0_none_b9389646c80384de\MsSense.exe
"C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.15063.0_none_b9389646c80384de\MsSense.exe"
6⤵
PID:8540

C:\Windows\SysWOW64\certutil.exe
"C:\Windows\System32\certutil.exe"
6⤵
PID:10160

C:\Windows\WinSxS\x86_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_c2dd647ead0a6f20\aspnet_wp.exe
"C:\Windows\WinSxS\x86_netfx4-aspnet_wp_exe_b03f5f7f11d50a3a_4.0.15552.17062_none_c2dd647ead0a6f20\aspnet_wp.exe"
6⤵
PID:10080

C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe
"C:\Windows\System32\SystemPropertiesAdvanced.exe"
6⤵
PID:13400

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe"
7⤵
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 764
8⤵
- Program crash
PID:6396

C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.15063.0_none_94b8eb25116a42e2\UserAccountControlSettings.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-u..ountcontrolsettings_31bf3856ad364e35_10.0.15063.0_none_94b8eb25116a42e2\UserAccountControlSettings.exe"
9⤵
PID:13340

C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.15063.0_none_4153431b7e6a9b04\msfeedssync.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-ie-feedsbs_31bf3856ad364e35_11.0.15063.0_none_4153431b7e6a9b04\msfeedssync.exe"
9⤵
PID:9628

C:\Windows\SysWOW64\OneDriveSetup.exe
"C:\Windows\SysWOW64\OneDriveSetup.exe"
9⤵
PID:7412

C:\Windows\SysWOW64\OneDriveSetup.exe
C:\Windows\SysWOW64\OneDriveSetup.exe /peruser /childprocess
10⤵
PID:2944

C:\Windows\SysWOW64\Register-CimProvider.exe
"C:\Windows\System32\Register-CimProvider.exe"
11⤵
PID:10736

C:\Windows\SysWOW64\auditpol.exe
"C:\Windows\System32\auditpol.exe"
10⤵
PID:11608

C:\Windows\SysWOW64\wecutil.exe
"C:\Windows\System32\wecutil.exe"
7⤵
PID:11440

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\System32\colorcpl.exe"
7⤵
PID:5660

C:\Windows\WinSxS\wow64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.15063.0_none_bc5df2ee9ea7994d\RMActivate.exe
"C:\Windows\WinSxS\wow64_microsoft-windows-s..sor-native-whitebox_31bf3856ad364e35_10.0.15063.0_none_bc5df2ee9ea7994d\RMActivate.exe"
7⤵
PID:9944

C:\Windows\WinSxS\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.15063.0_none_1618b8867f46668a\logman.exe
"C:\Windows\WinSxS\x86_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_10.0.15063.0_none_1618b8867f46668a\logman.exe"
7⤵
PID:8916

C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.15063.0_none_be549efe47bbc296\TiFileFetcher.exe
"C:\Windows\WinSxS\x86_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.15063.0_none_be549efe47bbc296\TiFileFetcher.exe"
7⤵
PID:7132

C:\Windows\SysWOW64\unregmp2.exe
"C:\Windows\System32\unregmp2.exe"
7⤵
PID:14516

C:\Windows\WinSxS\amd64_netfx4-datasvcutil_b03f5f7f11d50a3a_4.0.15552.17062_none_29034f8a62dfb1a8\DataSvcUtil.exe
"C:\Windows\WinSxS\amd64_netfx4-datasvcutil_b03f5f7f11d50a3a_4.0.15552.17062_none_29034f8a62dfb1a8\DataSvcUtil.exe"
7⤵
PID:15120

C:\Windows\WinSxS\amd64_microsoft-windows-wallpaperhost_31bf3856ad364e35_10.0.15063.0_none_6f17d0d7de2b430c\WallpaperHost.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-wallpaperhost_31bf3856ad364e35_10.0.15063.0_none_6f17d0d7de2b430c\WallpaperHost.exe"
7⤵
PID:5968

C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe
"C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe"
7⤵
PID:15032

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
7⤵
PID:14956

C:\Windows\WinSxS\wow64_microsoft-windows-tzutil_31bf3856ad364e35_10.0.15063.0_none_4fac586470568bab\tzutil.exe
"C:\Windows\WinSxS\wow64_microsoft-windows-tzutil_31bf3856ad364e35_10.0.15063.0_none_4fac586470568bab\tzutil.exe"
7⤵
PID:11880

C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.15063.0_none_63d0d6a16d896cde\wscript.exe
"C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.15063.0_none_63d0d6a16d896cde\wscript.exe"
7⤵
PID:14900

C:\Windows\SysWOW64\wsmprovhost.exe
"C:\Windows\System32\wsmprovhost.exe"
7⤵
PID:14712

C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.15063.0_none_fe45181eaae96324\IMJPUEX.EXE
"C:\Windows\WinSxS\amd64_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.15063.0_none_fe45181eaae96324\IMJPUEX.EXE"
7⤵
PID:15216

C:\Windows\SysWOW64\Magnify.exe
"C:\Windows\System32\Magnify.exe"
7⤵
PID:13388

C:\Windows\SysWOW64\ieUnatt.exe
"C:\Windows\System32\ieUnatt.exe"
7⤵
PID:6608

C:\Windows\WinSxS\x86_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.14917.0_none_b2100707c86bdd58\cvtres.exe
"C:\Windows\WinSxS\x86_netfx4-cvtres_exe_b03f5f7f11d50a3a_4.0.14917.0_none_b2100707c86bdd58\cvtres.exe"
7⤵
PID:14352

C:\Windows\SysWOW64\gpresult.exe
"C:\Windows\SysWOW64\gpresult.exe"
7⤵
PID:5024

C:\Windows\WinSxS\amd64_microsoft-windows-irftp_31bf3856ad364e35_10.0.15063.0_none_67ce1a25b7105221\irftp.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-irftp_31bf3856ad364e35_10.0.15063.0_none_67ce1a25b7105221\irftp.exe"
7⤵
PID:15184

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
7⤵
PID:4420

C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe
"C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe"
7⤵
PID:12516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13400 -s 2208
7⤵
- Program crash
PID:15336

C:\Windows\SysWOW64\net.exe
"C:\Windows\SysWOW64\net.exe"
8⤵
PID:11604

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1
9⤵
PID:744

C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.15063.0_none_f5c4329f31d2f5a9\tscon.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.15063.0_none_f5c4329f31d2f5a9\tscon.exe"
8⤵
PID:14912

C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.15063.0_none_60ff7f9434cd47f8\winload.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-b..ment-windows-minwin_31bf3856ad364e35_10.0.15063.0_none_60ff7f9434cd47f8\winload.exe"
8⤵
PID:15832

C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.15063.0_none_5537c7ef2c50bade\dllhst3g.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-com-surrogate_31bf3856ad364e35_10.0.15063.0_none_5537c7ef2c50bade\dllhst3g.exe"
8⤵
PID:15260

C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.15063.0_none_762d19250dfccce2\bthudtask.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.15063.0_none_762d19250dfccce2\bthudtask.exe"
8⤵
PID:11760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 13400 -s 2208
7⤵
- Program crash
PID:7740

C:\Windows\SysWOW64\runonce.exe
"C:\Windows\System32\runonce.exe"
8⤵
PID:15572

C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe
"C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe"
8⤵
PID:15528

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
8⤵
PID:15716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 15716 -s 380
9⤵
- Program crash
PID:9368

C:\Windows\SysWOW64\LaunchTM.exe
"C:\Windows\System32\LaunchTM.exe"
10⤵
PID:15304

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:3920

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:9236

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 9236 -s 652
5⤵
- Program crash
PID:5704

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:10560

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:14076

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:9368

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:9968

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8648

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:8432

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7440

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7344

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8996

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:10372

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7976

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:3760

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:3752

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6960

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:10040

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:10828

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:10892

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:9584

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11180

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:5532

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:10232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10232 -s 652
5⤵
- Program crash
PID:9368

C:\Windows\WinSxS\wow64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.15063.0_none_cdc1fcf8bea2c765\mountvol.exe
"C:\Windows\WinSxS\wow64_microsoft-windows-mountvol_31bf3856ad364e35_10.0.15063.0_none_cdc1fcf8bea2c765\mountvol.exe"
6⤵
PID:12620

C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.15063.0_none_b8efbb5654d028f8\clip.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-clip_31bf3856ad364e35_10.0.15063.0_none_b8efbb5654d028f8\clip.exe"
6⤵
PID:11764

C:\Windows\WinSxS\amd64_netfx-ieexec_b03f5f7f11d50a3a_10.0.15063.0_none_62c5d8cc15957bd9\IEExec.exe
"C:\Windows\WinSxS\amd64_netfx-ieexec_b03f5f7f11d50a3a_10.0.15063.0_none_62c5d8cc15957bd9\IEExec.exe"
6⤵
PID:4132

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 640
7⤵
PID:3660

C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.15063.0_none_3952819293249261\taskhostw.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-taskhost_31bf3856ad364e35_10.0.15063.0_none_3952819293249261\taskhostw.exe"
6⤵
PID:13828

C:\Windows\SysWOW64\RpcPing.exe
"C:\Windows\System32\RpcPing.exe"
6⤵
PID:14208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 10232 -s 684
5⤵
- Program crash
PID:1756

C:\Windows\WinSxS\wow64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.15063.0_none_ca4fb1a61eee0907\SecEdit.exe
"C:\Windows\WinSxS\wow64_microsoft-windows-security-secedit_31bf3856ad364e35_10.0.15063.0_none_ca4fb1a61eee0907\SecEdit.exe"
6⤵
PID:13984

C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.15063.0_none_ac29a10019bef2b0\rmttpmvscmgrsvr.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-s..artcard-tpm-manager_31bf3856ad364e35_10.0.15063.0_none_ac29a10019bef2b0\rmttpmvscmgrsvr.exe"
6⤵
PID:12492

C:\Windows\WinSxS\amd64_microsoft-windows-compat-generaltel_31bf3856ad364e35_10.0.15063.0_none_c67ebd76c63f878a\CompatTelRunner.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-compat-generaltel_31bf3856ad364e35_10.0.15063.0_none_c67ebd76c63f878a\CompatTelRunner.exe"
6⤵
PID:12868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1756 -s 1572
6⤵
- Program crash
PID:8780

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11868

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:10592

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11372

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:10532

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:10688

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:3760

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12000

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:3416

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11024

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11212

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11620

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11180

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11016

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8928

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:10836

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:12892

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13076

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6928

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7460

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:5532

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11092

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:6768

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:10092

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8160

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:14332

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11632

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12564

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:12692

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13488

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8200

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12544

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:13268

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:14008

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:14120

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:8460

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:3596

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11180

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:10836

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7404

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:10924

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:3740

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:3088

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:3740

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8416

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:9944

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7424

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:14008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14008 -s 700
5⤵
- Program crash
PID:13016

C:\Windows\WinSxS\amd64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.15063.0_none_a736a4aecdd85944\driverquery.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-driverquery_31bf3856ad364e35_10.0.15063.0_none_a736a4aecdd85944\driverquery.exe"
6⤵
PID:8576

C:\Windows\WinSxS\amd64_microsoft-windows-openfiles_31bf3856ad364e35_10.0.15063.0_none_f83a403a2332e36b\openfiles.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-openfiles_31bf3856ad364e35_10.0.15063.0_none_f83a403a2332e36b\openfiles.exe"
6⤵
PID:6136

C:\Windows\WinSxS\amd64_microsoft-windows-printing-dialoghost_31bf3856ad364e35_10.0.15063.0_none_45b8a69fcfd72d8c\PrintDialogHost.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-printing-dialoghost_31bf3856ad364e35_10.0.15063.0_none_45b8a69fcfd72d8c\PrintDialogHost.exe"
6⤵
PID:15224

C:\Windows\WinSxS\amd64_netfx4-microsoft.workflow.compiler_b03f5f7f11d50a3a_4.0.15552.17062_none_c6aea04e772bb3d8\Microsoft.Workflow.Compiler.exe
"C:\Windows\WinSxS\amd64_netfx4-microsoft.workflow.compiler_b03f5f7f11d50a3a_4.0.15552.17062_none_c6aea04e772bb3d8\Microsoft.Workflow.Compiler.exe"
6⤵
PID:14412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14008 -s 700
5⤵
- Program crash
PID:4560

C:\Windows\SysWOW64\openfiles.exe
"C:\Windows\System32\openfiles.exe"
6⤵
PID:11104

C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.15063.0_none_01175375b63af00c\ntprint.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-ntprint_31bf3856ad364e35_10.0.15063.0_none_01175375b63af00c\ntprint.exe"
6⤵
PID:14280

C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.15063.0_none_4403434aa91e2007\fodhelper.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-fodhelper-ux_31bf3856ad364e35_10.0.15063.0_none_4403434aa91e2007\fodhelper.exe"
6⤵
PID:12340

C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe
"C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe"
6⤵
PID:14996

C:\Windows\SysWOW64\cliconfg.exe
"C:\Windows\SysWOW64\cliconfg.exe"
6⤵
PID:8464

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:5632

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12940

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8128

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:7856

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:10324

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 11444 -s 680
5⤵
- Program crash
PID:8272

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe"
6⤵
PID:12952

C:\Windows\WinSxS\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.15063.0_none_a2267c9af28bf1ee\IMJPDCT.EXE
"C:\Windows\WinSxS\x86_microsoft-windows-d..-japanese-utilities_31bf3856ad364e35_10.0.15063.0_none_a2267c9af28bf1ee\IMJPDCT.EXE"
5⤵
PID:14704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14704 -s 724
6⤵
- Program crash
PID:14904

C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.15063.0_none_dd86505400f5b57f\AppVNice.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.15063.0_none_dd86505400f5b57f\AppVNice.exe"
7⤵
PID:14564

C:\Windows\WinSxS\x86_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.15063.0_none_1d05d13997d98c96\certreq.exe
"C:\Windows\WinSxS\x86_microsoft-windows-certificaterequesttool_31bf3856ad364e35_10.0.15063.0_none_1d05d13997d98c96\certreq.exe"
7⤵
PID:14788

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:13832

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:2956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2956 -s 652
5⤵
- Program crash
PID:4456

C:\Windows\SysWOW64\tasklist.exe
"C:\Windows\SysWOW64\tasklist.exe"
6⤵
- Enumerates processes with tasklist
PID:14528

C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.15063.0_none_f1b349ef3fbb95bd\mmgaserver.exe
"C:\Windows\WinSxS\wow64_microsoft-windows-mapi-mmga_31bf3856ad364e35_10.0.15063.0_none_f1b349ef3fbb95bd\mmgaserver.exe"
6⤵
PID:15188

C:\Windows\WinSxS\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.15063.0_none_d9950989c992f5c0\ImagingDevices.exe
"C:\Windows\WinSxS\x86_microsoft-windows-i..devicescontrolpanel_31bf3856ad364e35_10.0.15063.0_none_d9950989c992f5c0\ImagingDevices.exe"
6⤵
PID:3132

C:\Windows\SysWOW64\ctfmon.exe
"C:\Windows\SysWOW64\ctfmon.exe"
5⤵
PID:6440

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:12412

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6248

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11372

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:14808

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:15040

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13404

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:13848

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:15352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 15352 -s 700
5⤵
- Program crash
PID:15052

C:\Windows\SysWOW64\mfpmp.exe
"C:\Windows\SysWOW64\mfpmp.exe"
6⤵
PID:14884

C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.15063.0_none_bffab419244e0aae\LaunchTM.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.15063.0_none_bffab419244e0aae\LaunchTM.exe"
6⤵
PID:15172

C:\Windows\System32\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
7⤵
PID:3868

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe"
6⤵
PID:4456

C:\Windows\SysWOW64\sfc.exe
"C:\Windows\System32\sfc.exe"
6⤵
PID:15188

C:\Windows\SysWOW64\esentutl.exe
"C:\Windows\System32\esentutl.exe"
6⤵
PID:14416

C:\Windows\SysWOW64\proquota.exe
"C:\Windows\System32\proquota.exe"
6⤵
PID:14940

C:\Windows\WinSxS\wow64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.15063.0_none_e6e8f77bd3a209e8\nslookup.exe
"C:\Windows\WinSxS\wow64_microsoft-windows-nslookup_31bf3856ad364e35_10.0.15063.0_none_e6e8f77bd3a209e8\nslookup.exe"
6⤵
PID:10364

C:\Windows\SysWOW64\LaunchTM.exe
"C:\Windows\SysWOW64\LaunchTM.exe"
6⤵
PID:14132

C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.15063.0_none_7e580f9a965a8a9b\cleanmgr.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.15063.0_none_7e580f9a965a8a9b\cleanmgr.exe"
6⤵
PID:14636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 15352 -s 736
5⤵
- Program crash
PID:12040

C:\Windows\WinSxS\amd64_microsoft-windows-whoami_31bf3856ad364e35_10.0.15063.0_none_df90578fbaa4e229\whoami.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-whoami_31bf3856ad364e35_10.0.15063.0_none_df90578fbaa4e229\whoami.exe"
6⤵
PID:12936

C:\Windows\SysWOW64\Dism\DismHost.exe
"C:\Windows\System32\Dism\DismHost.exe"
6⤵
PID:14600

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:14452

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:8044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8044 -s 696
5⤵
- Program crash
PID:11368

C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.15063.0_none_b47e9249fd746ecc\dfrgui.exe
"C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.15063.0_none_b47e9249fd746ecc\dfrgui.exe"
6⤵
PID:14492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
6⤵
PID:4380

C:\Windows\SysWOW64\powercfg.exe
"C:\Windows\SysWOW64\powercfg.exe"
6⤵
PID:8988

C:\Windows\SysWOW64\find.exe
"C:\Windows\SysWOW64\find.exe"
6⤵
PID:508

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\System32\ipconfig.exe"
6⤵
- Gathers network information
PID:15140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 11368 -s 1952
6⤵
- Program crash
PID:11604

C:\Windows\SysWOW64\printui.exe
"C:\Windows\SysWOW64\printui.exe"
6⤵
PID:15004

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe"
6⤵
PID:15288

C:\Windows\SysWOW64\shutdown.exe
"C:\Windows\System32\shutdown.exe"
6⤵
PID:9736

C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.15063.0_none_6be0a7b050a62d2f\VSSVC.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-vssservice_31bf3856ad364e35_10.0.15063.0_none_6be0a7b050a62d2f\VSSVC.exe"
6⤵
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8044 -s 696
5⤵
- Program crash
PID:15220

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
6⤵
PID:14792

C:\Windows\SysWOW64\cttune.exe
"C:\Windows\System32\cttune.exe"
6⤵
PID:11104

C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.15063.0_none_4e2f7735bc0d9e16\ARP.EXE
"C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.15063.0_none_4e2f7735bc0d9e16\ARP.EXE"
6⤵
PID:14136

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:13676

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:15300

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:14948

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:14708

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:10660

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:15192

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:15248

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:14368

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:15160

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:3308

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:14940

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:2188

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11384

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:14172

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:8572

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:14564

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:15196

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:15096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 15096 -s 696
5⤵
- Program crash
PID:13076

C:\Windows\WinSxS\x86_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.15063.0_none_9efebbf70fe05fe0\comrepl.exe
"C:\Windows\WinSxS\x86_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.15063.0_none_9efebbf70fe05fe0\comrepl.exe"
6⤵
PID:15156

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
6⤵
PID:8584

C:\Windows\SysWOW64\OpenWith.exe
"C:\Windows\SysWOW64\OpenWith.exe"
6⤵
PID:14344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 15096 -s 392
5⤵
- Program crash
PID:4808

C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.15063.0_none_685fe984eaf6056e\appidcertstorecheck.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-appid_31bf3856ad364e35_10.0.15063.0_none_685fe984eaf6056e\appidcertstorecheck.exe"
6⤵
PID:3376

C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.15063.0_none_96cb8ad5c830676e\IMESEARCH.EXE
"C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.15063.0_none_96cb8ad5c830676e\IMESEARCH.EXE"
6⤵
PID:14340

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:14920

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:15236

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:14800

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:2188

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:15248

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13664

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:7108

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:14836

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:13568

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13232

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:13688

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:14940

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:1508

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:14532

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:316

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:15084

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:2332

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:12620

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:14420

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:14776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14776 -s 704
5⤵
- Program crash
PID:14984

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:15088

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:3076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3076 -s 680
5⤵
- Program crash
PID:15100

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:14688

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:8900

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8900 -s 700
5⤵
- Program crash
PID:15264

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\SysWOW64\forfiles.exe"
6⤵
PID:15624

C:\Windows\SysWOW64\cmd.exe
/c echo "0409"
7⤵
PID:15864

C:\Windows\SysWOW64\cmd.exe
/c echo "12520437.cpx"
7⤵
PID:15960

C:\Windows\SysWOW64\cmd.exe
/c echo "12520850.cpx"
7⤵
PID:16044

C:\Windows\SysWOW64\cmd.exe
/c echo "@AudioToastIcon.png"
7⤵
PID:15376

C:\Windows\SysWOW64\dvdplay.exe
"C:\Windows\System32\dvdplay.exe"
7⤵
PID:15812

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
/device:dvd
8⤵
PID:15836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 15836 -s 896
9⤵
- Program crash
PID:12940

C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.15063.0_none_41652c9a9e54011f\hvix64.exe
"C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.15063.0_none_41652c9a9e54011f\hvix64.exe"
10⤵
PID:15976

C:\Windows\SysWOW64\InstallAgentUserBroker.exe
"C:\Windows\System32\InstallAgentUserBroker.exe"
10⤵
PID:15524

C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_10.0.15063.0_none_8a6a790ce079de7f\aspnet_compiler.exe
"C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_10.0.15063.0_none_8a6a790ce079de7f\aspnet_compiler.exe"
10⤵
PID:16328

C:\Windows\SysWOW64\cmd.exe
/c echo "@EnrollmentToastIcon.png"
7⤵
PID:14624

C:\Windows\SysWOW64\cmd.exe
/c echo "@VpnToastIcon.png"
7⤵
PID:16128

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\System32\mshta.exe"
7⤵
PID:16000

C:\Windows\SysWOW64\cmd.exe
/c echo "aadtb.dll"
7⤵
PID:15548

C:\Windows\SysWOW64\cmd.exe
/c echo "AboveLockAppHost.dll"
7⤵
PID:16104

C:\Windows\SysWOW64\CertEnrollCtrl.exe
"C:\Windows\SysWOW64\CertEnrollCtrl.exe"
5⤵
PID:16196

C:\Windows\WinSxS\x86_jsc_b03f5f7f11d50a3a_4.0.15552.17062_none_b7205562ffbc3d7e\jsc.exe
"C:\Windows\WinSxS\x86_jsc_b03f5f7f11d50a3a_4.0.15552.17062_none_b7205562ffbc3d7e\jsc.exe"
6⤵
PID:7844

C:\Windows\WinSxS\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.15063.0_none_701bfed8b503823d\csc.exe
"C:\Windows\WinSxS\amd64_netfx-csharp_compiler_csc_b03f5f7f11d50a3a_10.0.15063.0_none_701bfed8b503823d\csc.exe"
6⤵
PID:15776

C:\Windows\SystemApps\holocamera_cw5n1h2txyewy\HoloCameraApp.exe
"C:\Windows\SystemApps\holocamera_cw5n1h2txyewy\HoloCameraApp.exe"
6⤵
PID:984

C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.15063.0_none_92ce01ad7e234d32\PrintBrmEngine.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_10.0.15063.0_none_92ce01ad7e234d32\PrintBrmEngine.exe"
6⤵
PID:16320

C:\Windows\SysWOW64\quickassist.exe
"C:\Windows\SysWOW64\quickassist.exe"
6⤵
PID:5832

C:\Windows\WinSxS\x86_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.14917.0_none_e1afe6a329d37c78\aspnet_regiis.exe
"C:\Windows\WinSxS\x86_netfx4-aspnet_regiis_exe_b03f5f7f11d50a3a_4.0.14917.0_none_e1afe6a329d37c78\aspnet_regiis.exe"
6⤵
PID:14288

C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.15063.0_none_009279fe31499ac6\sysprep.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-sysprep_31bf3856ad364e35_10.0.15063.0_none_009279fe31499ac6\sysprep.exe"
6⤵
PID:16140

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:15096

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:14732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14732 -s 680
5⤵
- Program crash
PID:5212

C:\Windows\SysWOW64\EaseOfAccessDialog.exe
"C:\Windows\SysWOW64\EaseOfAccessDialog.exe"
5⤵
PID:16068

C:\Windows\SysWOW64\OpenWith.exe
"C:\Windows\SysWOW64\OpenWith.exe"
5⤵
PID:5076

C:\Windows\WinSxS\amd64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.15063.0_none_7da85cf8d4de2361\InfDefaultInstall.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-infdefaultinstall_31bf3856ad364e35_10.0.15063.0_none_7da85cf8d4de2361\InfDefaultInstall.exe"
5⤵
PID:14444

C:\Windows\SysWOW64\sfc.exe
"C:\Windows\System32\sfc.exe"
5⤵
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14732 -s 768
5⤵
- Program crash
PID:16036

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:4312

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:13784

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:11868

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:14388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 14388 -s 684
5⤵
- Program crash
PID:14032

C:\Windows\WinSxS\x86_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.15063.0_none_9efebbf70fe05fe0\comrepl.exe
"C:\Windows\WinSxS\x86_microsoft-windows-c..mplus-admin-comrepl_31bf3856ad364e35_10.0.15063.0_none_9efebbf70fe05fe0\comrepl.exe"
6⤵
PID:15556

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:15332

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:15936

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:16088

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:11972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 11972 -s 688
5⤵
- Program crash
PID:15452

C:\Windows\SysWOW64\regini.exe
"C:\Windows\System32\regini.exe"
6⤵
PID:13116

C:\Windows\WinSxS\amd64_microsoft-windows-oobe-firstlogonanimexe_31bf3856ad364e35_10.0.15063.0_none_dc62da3fc66fefa8\FirstLogonAnim.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-oobe-firstlogonanimexe_31bf3856ad364e35_10.0.15063.0_none_dc62da3fc66fefa8\FirstLogonAnim.exe"
6⤵
PID:15852

C:\Windows\SysWOW64\GamePanel.exe
"C:\Windows\System32\GamePanel.exe"
5⤵
PID:16080

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:15636

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:4112

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:15660

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:2748

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:15412

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:16056

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:16304

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:15892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 15892 -s 684
5⤵
- Program crash
PID:3592

C:\Windows\WinSxS\msil_smsvchost_b03f5f7f11d50a3a_4.0.15552.17062_none_21a6073a7cb68dd3\SMSvcHost.exe
"C:\Windows\WinSxS\msil_smsvchost_b03f5f7f11d50a3a_4.0.15552.17062_none_21a6073a7cb68dd3\SMSvcHost.exe"
6⤵
PID:15480

C:\Windows\WinSxS\wow64_microsoft-windows-w..client-installagent_31bf3856ad364e35_10.0.15063.0_none_053a926c712c32b7\InstallAgent.exe
"C:\Windows\WinSxS\wow64_microsoft-windows-w..client-installagent_31bf3856ad364e35_10.0.15063.0_none_053a926c712c32b7\InstallAgent.exe"
6⤵
PID:15736

C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.15063.0_none_c4f067d86940c645\plasrv.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-p..rastructureconsumer_31bf3856ad364e35_10.0.15063.0_none_c4f067d86940c645\plasrv.exe"
5⤵
PID:15960

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:16352

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:1864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1864 -s 680
5⤵
- Program crash
PID:5196

C:\Windows\SysWOW64\ARP.EXE
"C:\Windows\System32\ARP.EXE"
6⤵
PID:8576

C:\Windows\WinSxS\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.15063.0_none_2c028519c752071f\dccw.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-icm-dccw_31bf3856ad364e35_10.0.15063.0_none_2c028519c752071f\dccw.exe"
6⤵
PID:2196

C:\Windows\WinSxS\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_10.0.15063.0_none_13bd6038fc5ee6d4\sapisvr.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-speechcommonnoia64_31bf3856ad364e35_10.0.15063.0_none_13bd6038fc5ee6d4\sapisvr.exe"
5⤵
PID:12992

C:\Windows\WinSxS\amd64_microsoft-windows-browser-webcache_31bf3856ad364e35_11.0.15063.0_none_701340687003ca5a\WebCache.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-browser-webcache_31bf3856ad364e35_11.0.15063.0_none_701340687003ca5a\WebCache.exe"
5⤵
PID:15528

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:15632

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:6440

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:15780

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:16040

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:12544

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Program Files (x86)\Teletubisie\1.vbs"
4⤵
PID:16068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16068 -s 696
5⤵
- Program crash
PID:5660

C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe
"C:\Windows\SystemApps\Microsoft.LockApp_cw5n1h2txyewy\LockApp.exe"
6⤵
PID:13752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 1584
6⤵
- Program crash
PID:10128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 16068 -s 716
5⤵
- Program crash
PID:8208

C:\Windows\WinSxS\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.15063.0_none_7e87512a075903a1\AppLaunch.exe
"C:\Windows\WinSxS\x86_netfx-applaunch_exe_b03f5f7f11d50a3a_10.0.15063.0_none_7e87512a075903a1\AppLaunch.exe"
6⤵
PID:9256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 8208 -s 1336
6⤵
- Program crash
PID:6328

C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.15063.0_none_085c61111d15254c\SystemPropertiesAdvanced.exe
"C:\Windows\WinSxS\amd64_microsoft-windows-s..mpropertiesadvanced_31bf3856ad364e35_10.0.15063.0_none_085c61111d15254c\SystemPropertiesAdvanced.exe"
6⤵
PID:1356

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K matrix.bat
4⤵
PID:15964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7064 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:1704

C:\Users\Admin\Downloads\Teletubisie Setup.exe
"C:\Users\Admin\Downloads\Teletubisie Setup.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:8204

C:\Users\Admin\Downloads\Bonzify.exe
"C:\Users\Admin\Downloads\Bonzify.exe"
2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:8484

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\KillAgent.bat"
3⤵
PID:8544

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im AgentSvr.exe
4⤵
- Kills process with taskkill
PID:8684

C:\Windows\SysWOW64\takeown.exe
takeown /r /d y /f C:\Windows\MsAgent
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:9092

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\MsAgent /c /t /grant "everyone":(f)
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:9108

C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
INSTALLER.exe /q
3⤵
PID:12264

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
4⤵
PID:12672

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
4⤵
PID:12896

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
4⤵
PID:12920

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
4⤵
PID:13020

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
4⤵
PID:13092

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
4⤵
PID:13224

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
4⤵
PID:13288

C:\Windows\msagent\AgentSvr.exe
"C:\Windows\msagent\AgentSvr.exe" /regserver
4⤵
PID:11628

C:\Windows\SysWOW64\grpconv.exe
grpconv.exe -o
4⤵
PID:12304

C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
INSTALLER.exe /q
3⤵
PID:12528

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
4⤵
PID:11980

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
4⤵
PID:12348

C:\Windows\SysWOW64\grpconv.exe
grpconv.exe -o
4⤵
PID:12468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=2940 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:1
2⤵
PID:14208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2896 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:13284

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7120 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:12160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=3644 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:1
2⤵
PID:14352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=6904 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:1
2⤵
PID:11692

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4876 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:14832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5176 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:11444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1768 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:14340

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7060 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:12960

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3040 --field-trial-handle=1816,i,4042094943644800579,11497107693090324650,131072 /prefetch:8
2⤵
PID:6572

C:\Users\Admin\Downloads\LogonFuck.exe
"C:\Users\Admin\Downloads\LogonFuck.exe"
2⤵
PID:6744

C:\Windows\System32\takeown.exe
"C:\Windows\System32\takeown.exe" /f C:\Windows\System32\LogonUI.exe
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:15512

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4968

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:9756

C:\Windows\msagent\AgentSvr.exe
C:\Windows\msagent\AgentSvr.exe -Embedding
1⤵
PID:11628

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x428
1⤵
PID:9520

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:13748

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" OptionalFeaturesAdminHelper
2⤵
PID:14764

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:6188

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:6928

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:12868

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\ee5b5e2ae5a24a73ba7c29a702863e00 /t 1476 /p 13220
1⤵
PID:3128

C:\Windows\SysWOW64\edpnotify.exe
"C:\Windows\SysWOW64\edpnotify.exe"
2⤵
PID:15288

C:\Windows\SysWOW64\setx.exe
"C:\Windows\SysWOW64\setx.exe"
2⤵
PID:15428

C:\Windows\SysWOW64\ddodiag.exe
"C:\Windows\System32\ddodiag.exe"
2⤵
PID:15864

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
PID:6952

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
PID:15504

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:9184

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:15740

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:9512

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:13700

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:14676

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:14432

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:10896

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:7196

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:3760

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:10312

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:4296

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:15488

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
PID:13940

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
PID:14748

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DsSvc
1⤵
PID:15544

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Process Discovery

T1057

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Teletubisie\1.vbs
Filesize
44B

MD5
fe15fe4cbe1e028911cb13e42a107188

SHA1
8b55103bfaedd20fc7d6a933a599b9d263be87b0

SHA256
2bd456621c9b4fc894857f22ca950efb50eaf6276f058f6cd7376662ac67b681

SHA512
457f07f9c4ff55e9ee4c8efa532ffc29ad6fa901968618a7f6c97969632470d114359fabb33c69118d265f4ffdadd90b6c7866fd5c427d76044a47ff33da63eb

Download Submit
C:\Program Files (x86)\Teletubisie\killer.bat
Filesize
119B

MD5
899e26fb3d4d1fc4ef24cd2ce63e9f02

SHA1
48fc3b22103f06bcaf8ffd21a335cf76525e9f79

SHA256
56f5ff8cb31fbfe2fc1f5f968ffc9f756788dbd9530ed450b89244d99592de85

SHA512
bec1af1129841b6e56562a1d59eecbb4b311e09bfa40254b84362415eab5b7244a796587fcb4de1bc0f8506cd8e3449294584db68f29db4b7cb6ce350235cfeb

Download Submit
C:\Program Files (x86)\Teletubisie\matrix.bat
Filesize
115B

MD5
836a4288c54e3585ce13724a60794a50

SHA1
0789da7571e6e2b71cf60eabf7d4992a93298d9f

SHA256
ca3f7509d0b170f4b8003c1d5ce0b931a17b51a51bd215c71b1784b07611554b

SHA512
1aba49b7b8dc5ec1de3de6ce81376d328a99023ed8534f0c5f0bee27c167930aa63a49d045df14ffee6158bb267e226229096e9dff7ba2e4d3b59c942292157c

Download Submit
C:\Program Files (x86)\Teletubisie\teletubisie.bat
Filesize
227B

MD5
cf321312c739959c284ee2495384e081

SHA1
1da12a15762e4ac4cdb61afe8c4d3f47f8611a95

SHA256
db552b50073764c3d98811739b0d015e19b6f9f00684c333eebf2b0922994ebd

SHA512
2fae514ac7a81505ee8611c83b2347802c59e9520cd276000a7e46924c905dd81bcc991127c27247e8a7d6513c534e8ae7a713916dc681ed2c1b9e6e22e6e002

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003
Filesize
24KB

MD5
a5bb3bb3eda1301f6ac876a49d4b2f62

SHA1
1786309cdc2fb5c1d29cdac00dbdf13711f19f3a

SHA256
316ba0d916f3d3d945b42e589de9a0326836664f9a06e9680bb853c828c2bf35

SHA512
f2ab2d40d2ccd43c5e5bf2150ea79d575e0d4a41381a8fba3beb47a8944adeac0bd19dacdbe237f8dd1c06fc04403f0bda3fca1ec0fc429357dc705c6db1eea4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005
Filesize
48KB

MD5
0f2b395cc63db1bd8a5d093e558cbdd1

SHA1
833d0657cb836d456c251473ed16dfb7d25e6ebe

SHA256
f3797115dd01a366cce0fbd7e6148b79559767164d2aa584b042d10f1ffd926d

SHA512
e8a4ada76efb453c77a38d25d2bbd3a7f03df27b85e26ba231791d65d286fe654c024b64f9d6869824db5d1cf59e4d4eb662f5a55c326e5e249144ae1a66b798

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006
Filesize
44KB

MD5
13c12dd8035a11f88f36de3b9dc964a4

SHA1
25fb02df3f77368d59eac2e7a1c59fabfe9ac9b6

SHA256
f58cce418d2df873187a718cd5a0d609c711405480c1b56f004d304107c87171

SHA512
7944f16894141495458ea9957172ab4ede54eafc76c50280075ce55f9eca941ffe7c876f2ae2536d7492da0cb340aa8094681929b96a428bf9fedfa47c8dad86

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Filesize
20KB

MD5
0f3de113dc536643a187f641efae47f4

SHA1
729e48891d13fb7581697f5fee8175f60519615e

SHA256
9bef33945e76bc0012cdbd9941eab34f9472aca8e0ddbbaea52658423dc579f8

SHA512
8332bf7bd97ec1ebfc8e7fcf75132ca3f6dfd820863f2559ab22ac867aa882921f2b208ab76a6deb2e6fa2907bb0244851023af6c9960a77d3ad4101b314797f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000008
Filesize
21KB

MD5
6b528d140a964a09d3ebb5c32cd1e63a

SHA1
45a066db0228ee8d5a9514352dc6c7366c192833

SHA256
f08969d8ae8e49b96283000267f978d09b79218bb9e57037a12a19091d4a3208

SHA512
d3c281c3130735c89ddbf9b52de407da75a3d7ecbf0026e0de5995f40989883178cd59198354976aaa2aa7b47fc5f3f3856a59fe1463d4e2fdb7a27e9f10e76f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009
Filesize
59KB

MD5
4bc7fdb1eed64d29f27a427feea007b5

SHA1
62b5f0e1731484517796e3d512c5529d0af2666b

SHA256
05282cd78e71a5d9d14cc9676e20900a1d802016b721a48febec7b64e63775f6

SHA512
9900aecac98f2ca3d642a153dd5a53131b23ceec71dd9d3c59e83db24796a0db854f49629449a5c9fe4b7ca3afcdd294086f6b1ba724955551b622bc50e3ba1e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000a
Filesize
65KB

MD5
c5a7113d962c5eb74a8dcc7b0420dc68

SHA1
c348dc63331cd35611851a53aff9cfca3f27daaf

SHA256
a3f9455a7908ac86647d2af76e2f84cd8025da815fe98f65da0f31f40337066d

SHA512
c9960f3c54f43129c1069ac57a33acbeb4bd0cce8393838f541c12c51fea6566bafafb053d72402f001c3909df252073e335833c6318a89f6101c7aa46afa4cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
Filesize
19KB

MD5
bfff9d83b00a5aa9b944286ea3654726

SHA1
aac4c6e9f26a09c38aa59742b86313d4fed8a4c0

SHA256
90fe1ef718caa668c13dff783a028dcf133d7d9c5ceec7226312a182afe6cbd6

SHA512
ebe8fde5b6cd266a29bc731077ed905247bb6e9948996aeb38a91f200f77e588e514662713875db34279629b70ecf2bab326b6e152fe8dc4b7a595892e64a28c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c
Filesize
150KB

MD5
0b1dfab8142eadfeffb0a3efd0067e64

SHA1
219f95edd8b49ec2ba7aa5f8984a273cdaf50e6c

SHA256
8e2ee8d51cfcc41a6a3bfa07361573142d949903c29f75de5b4d68f81a1ae954

SHA512
6d1104fd4cfe086a55a0dd3104c44c4dba9b7f01e2d620804cf62c3753a74c56b5eae4c1dc87c74664e44f58a966ba10600de74fb5557b3c6c438e52cc4decdb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
Filesize
20KB

MD5
923a543cc619ea568f91b723d9fb1ef0

SHA1
6f4ade25559645c741d7327c6e16521e43d7e1f9

SHA256
bf7344209edb1be5a2886c425cf6334a102d76cbea1471fd50171e2ee92877cd

SHA512
a4153751761cd67465374828b0514d7773b8c4ed37779d1ecfd4f19be4faa171585c8ee0b4db59b556399d5d2b9809ba87e04d4715e9d090e1f488d02219d555

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000012
Filesize
69KB

MD5
805d4fdfc3d3e5ddd5391b8f361fa519

SHA1
5425f05d27964bc57cd879e16914bce5053ec743

SHA256
3924dabf7b129ad34cdd665768bff84c6ffa449b942cab5df2e30b0ea9efb659

SHA512
7a64df530a77faf100ba32d9cf82ca5d57f6f11f40a1e6688d695d3b726b807b6f7e34853fb2b7ecb30c137465618f09077031f42b24eb80ee90ab5c3a0bd8ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013
Filesize
325KB

MD5
68432b96cf51772bbe1a3f34235bfbe6

SHA1
7592f267453588ae30b1c739cf21d2c8bb706171

SHA256
e11e5ff6ccfd19bb7ce5d57bf560a1fae783d4cfcf6851ffa23f50447fc3177e

SHA512
1c46625d0be1d3e2b6a81c8b7ad7e360d458e5a3e02f3658c2abc7d78956fe5077668c8d095a3ee9a6b9c896e7a7cacc474c7275a0b5ea4b1d03fed77997b973

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000014
Filesize
141KB

MD5
eaa13f1f346132ee83cf7f5a5ca68bd0

SHA1
5a915903d07c00f37fdd9a78dd201d0ef2cd1ef2

SHA256
a965e3a33d3a320affb1b000d506cd0741dbba7c1f57519f8af0f049fdaeca42

SHA512
48c36e0e498fabb9d755d19286587d2c8b1d431c38ffec3b8bf30dcaa09c02a83b58b79a619d00520a0e9c17de7e061d6f85edc8296abce2f5d6b62da974d380

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021
Filesize
112KB

MD5
5df8d388a2ed028f5d0695c2d2c6c363

SHA1
9fe7c1c294a550b05b412cc522c2871db93e9bd0

SHA256
e75cb1db0f182d66c7198d556ca4a21455abbc6fbe857b26fdb99d5d7741ded1

SHA512
d4331ee603def663d3e13360f9276745122c650c72a28ad5967b379323fcfcbc5811ef9f26df79c299f8f317c445ae426430c190e26f620d64e21aa19f580865

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
Filesize
204KB

MD5
41785febb3bce5997812ab812909e7db

SHA1
c2dae6cfbf5e28bb34562db75601fadd1f67eacb

SHA256
696a298fa617f26115168d70442c29f2d854f595497ea2034124a7e27b036483

SHA512
b82cfd843b13487c79dc5c7f07c84a236cf2065d69c9e0a79d36ac1afc78fa04fba30c31903f48d1d2d44f17fb951002e90fb4e92b9eae7677dbb6f023e68919

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029
Filesize
21KB

MD5
d13799a914badab072031a06fda7f0eb

SHA1
3c28322d73ea38efb97593843fecc749b5393db1

SHA256
123c3facdefd1fb463a411f64f3fea8eda47a1e17deb6663d1fbc1fd5932b0fd

SHA512
2316fdcdec1441cf4a6b79ffaa853e889934f6dfadcf76262fa6b15de696b10a244b93f89d64b96ce9f082a488f1f00f233fc4cd2944d6073e8211199c2ffa5c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
Filesize
85KB

MD5
878dee037b3aabae725f4200ec9e878d

SHA1
56b33179e834ac29795bb42a7730e052166e6101

SHA256
c5818814a400dd1b9b7696b3b307e29b8636b8a663a8ec57cfe0f1d2f2132d1f

SHA512
a61cebe1a9d8565a677466503ee8495f6cb45cdd2176428f7445206479a29afd520815a9bc65bf4017e1f3330b3829fd4cddf204cd4fc2627c991ab3df61dfa9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
Filesize
46KB

MD5
f0d81b309d4441d6dc22bdcb9e9e7d01

SHA1
77e7510fd01735991f8eb242a8a20acf5c7326d6

SHA256
90b890766ed0dfc173b119f625e4bde7785d509a76d27354148bf0a80a09889c

SHA512
79d3758017eb11ff478e0c258405aeb66eeef77b6041689708667948c85c1ff27688491eb8fd7efba3e5d392e299c055b3ae54fd212a0f5caaca3d91c425829e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002f
Filesize
19KB

MD5
aaace359b85b7b4a2c7327dfb7beaa97

SHA1
582d8a59ced081f5fcda3e35721f8a3464927a74

SHA256
ed67895dc54bd5d6b94b889380288aa1bd1efbe14dd06ce4fa63794002994ee1

SHA512
68b908c77fb16a195cccfe531060ff7d5e0fa97bdb58ac860ea5d8c0f04e49ab3bf906839a971c4208360688153c9362e81054124f88d2dffb4101a065de1f0d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000030
Filesize
95KB

MD5
153d60394558c87594c259c5f60fca0f

SHA1
fbf6d8173b162b87def7a81b5beb4eef4113ec10

SHA256
c0ee0a1125398bc5952930082120228ca070aa5b386626d41e7e97998688db21

SHA512
a836663dc80c0f3b8686a2edcb77fc54187f2c7079afef65165a76fa4aa56e5484bc75a1c219901f141d9a8dff9f282f6cf52b4e63ab8773d2a0c82d846e0623

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000031
Filesize
797KB

MD5
6532c7609ee1bb2692df2438ddc88fc3

SHA1
deac88a25324f16a9474aa92a7134a06f8b55371

SHA256
3ba8a3eb3401dbeb13e10370833a3cfaed13ccbb5750ff49e4709735b0304fa4

SHA512
06238022c59b42cb1dda20c9a0fd550bb9899c0428da0daefdfcb41931541e7d1ce4f3a6b3b86cc572f3eedc5dae51d4a5c185ff61bebaf93f3a4cdd7042a2ae

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003b
Filesize
21KB

MD5
ea48c33e2560afec958fe8c5396344bc

SHA1
2d83e09c5784df5c427e017cd312606df8e5bbe9

SHA256
fe6b76517c4f221c3241886d04702bb1ea480827d335ad37336cea28dd9c4df3

SHA512
3757c49932afd3eda89619a96572cf6d3f940b69d499ab83c6c14782fb320fb6e69681a33e8d9872e476cf697865f1bc358a01627ea455b3d97ecc772cf85d0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00003c
Filesize
24KB

MD5
6cbf8f829c02fb20c7025a2db54209a1

SHA1
a5c97ff92c09fb6d041e8c605233aff7f619f6bd

SHA256
beb80436725b4013784e4c1afde181c4b1179fcb193b48a408a63162c0ae1b5e

SHA512
d5529174a05906c3a3272256a68f555c70ba3a091bb11d9650d8b72d21323060fe35431b5179193ae38f7279efc87ea123e9381984e13611306c6f2bda09505b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\07a0c4a3e1abceea_0
Filesize
1KB

MD5
087fcf2b6adbbd09e44889ba092e4a8e

SHA1
2f5aefec52576db70ec59642026a18145c19ea53

SHA256
c6b68cc3273d48bfca9212be2ee62661c9e74605e8a4d2cb36ad2fabc4290296

SHA512
fdccbc3f2a85d5ad939d96d3b30c1331181bfcccd8acd4af680c03a90d12c6168a510f4cf73781c38569435764b9395d41a7b48f3d0b5fde8fe7837550d9fd77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\22bd894e0efdfa4e_0
Filesize
1KB

MD5
1b35f72c4eb40ce2d2f3b28ee37b9413

SHA1
88ed79f78eeb19230345a60ec87e0a4e45b2e422

SHA256
ae3a603e55e191ccabe682620531e3bfd31faf94463f1560606c3638bb230778

SHA512
2d75bf63ae32d0e207c235b1936d94f8ceaa64e10345b38db3c80445e2a38720ff3de32d8bba8c0b4b5e3f1013daae6f6e5890766213d56d1757df05a0e05a01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\230626c44da2ff73_0
Filesize
7KB

MD5
3a2c1d1200eb46cf9171196a0473316b

SHA1
47703f6b87bce09d6596d6a5ab6ae1a2d454e84f

SHA256
eb9a744ef5db1c4e1ce650e01e691441fc1905f3c90019f88d67fc4cf264e10d

SHA512
5b7d03e8391b8810c0925b614df28bf8baa1c9a99e37f88dd82b80d0ef8c4ad430409ccfcbddadc77e3c8752e9bffa8fea252a8ff77b6d4f7a4d3789c2b66833

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3a5be43e36c07b87_0
Filesize
2KB

MD5
3e295caaab7570276c682ee04367ad35

SHA1
c808157c196068d8aa2832ca7d17c8420bf59fd9

SHA256
b8f25c0b8f4df70987eaa1226805732948d39085f97dfb0ce5922cdaee430035

SHA512
f5775664bd6d741821e12fc8f52d1c4bd0d13d9acfe2c3917b53243eb8be547319ee0f4f3122fca7a17f09efd2215894802a9496bec04bf0e3cfc424594a1540

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\3c1b71d6c92f4ff2_0
Filesize
13KB

MD5
cef9fe66ee28c5cf35fbac964c0a95f1

SHA1
8cafbbb6cacd9b0460dc03df3c25ce218bc7b0b1

SHA256
f7cf423171da2945e6c23e9c9c3b8942ac5a123d789f5dfd8c7e406f9256ddd2

SHA512
85d5aee84e1505e058b9fd7080fb747cf8f61b8faa5f96a071c84c23a082e297011101c8b558ce55accd4601b288806cbe2fa016f72bd43d3a4f9f38b70247fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\50e7ca177d06e22b_0
Filesize
2KB

MD5
0dc44da5fe6520af6463311dde240c79

SHA1
9aa25156ff3c4f7992961895d4be882ff5b7dedf

SHA256
f410aacd5b68ee559ecca26b455591afaaa96840dc683a4bbec04116b6550a6f

SHA512
13f26439fe0da747a767a232619fa56511eb198bf63ae099e4166b3f38480f0118318434cfdf8d0649a989b31fa483219085c3631594af085e919df18661815e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\81037e226035aa29_0
Filesize
7KB

MD5
a25403ec9b4a488789d11bfa928bd278

SHA1
d12558ba11356da5cf0f0d8eb5059938ecc5c2d6

SHA256
73e1030c18d7335a1ff31fac6b6c4fc6db1de3e713ce0ab469a3f5e2a14bcd78

SHA512
108f3c0fa2a4a069b48df98942ef952c85961f4c9b5a298ac17f7d0f319ebc8d0ed03a904469587c14dedbbc2cb0e04d3b0669f14a8d896373463bb5a1453246

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\890341016b4cb769_0
Filesize
1KB

MD5
593b81437190e0052bc011fbfa682714

SHA1
140383f292d52f43be46d8db675172197a4590eb

SHA256
5d79c948ce3a6639f83d12bbb6a78c7c37ef164acd65cf144ccfcc6bcf483030

SHA512
01d44a6be05ceddf44ef2747aff121479840d6b92f496ab99e0dc9423fea5179afea5e7e994392948dafd096b5ec92e63c8090ee80f299e3817e400567d9f058

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\8b0e541cef36724d_0
Filesize
3KB

MD5
fc92e7a7cbf620090603f33152fb2a37

SHA1
a175830907cfc2f1f171d0027812afb43a3d2644

SHA256
b678a1991c692015f3b9c1032b3a051514d14eff9d73f41966357325052deccf

SHA512
84bb3a865a137e8364ee6638ec3cc6fe51c6b469ccb7afbe4889ad4a5c7694bf233643b7966dd958302b44fae233c4b72e10e7b4cd6c8a47df4b0888329213ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\94068e3028d75c6f_0
Filesize
1KB

MD5
b3f481ba4648adc8f5fd42aa1df41bd5

SHA1
34a2e4f61b55b0c8780523a7738bc0c2e2e36b65

SHA256
28ccfcb161a505e2297c08d1870bb0fff16bc1db0b3813d0bc8852fc69040c76

SHA512
830f1efe818d1af4502839e55853a0d38c6721bcd8c51153ff707a20bea83d1823c748b46bfc5751d0144b8b50e39e5029892da22664340ee617d7c1d7172e65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b5c0b0d2ff0cad95_0
Filesize
324B

MD5
b1a4609d72056f7776b5953bf5e2d4e8

SHA1
e5e05aa35d95b9d01cca0476d9c03b09eb8e8297

SHA256
e350aba915b53e33b5fee9443cf68f4f4f0d2b7c07fc514bc74d4af628e1851b

SHA512
12c3a14cd3e20ecd3fda0ed5abf761aa47065f54c574144cc910a89fd154e9c7cb1fb43ed47f3fdd270e06dd2d9cb26f6d092abb3caa67c2e80c59ae0f4319cb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\b988d1f600c90206_0
Filesize
34KB

MD5
a14618d2b26f285d994d4daa05475325

SHA1
d7c1953759f31dc2dae9938b26cf01cff1e4567e

SHA256
f1985fc59b9ac31f2d1a816210ae4102057b68f7c52b5b12397518b50e8506f2

SHA512
1481457e7d0aa3b7197167b1eab612b4034a177090e2a373fcfe080a4e5c4f5b8440c91262d86e958d74441771eda4470cbaeafd1d5a0e8cfa1f68c8864a5540

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\c93622985013877f_0
Filesize
2KB

MD5
d5962da3975c894bdb7a94cf9ced3497

SHA1
ef2ec5616b0936a6bf089b36aab683265187fc92

SHA256
f76d3d53949e6e1097a96e1a8ad3cdee713848f8304399e317b581b678d799b3

SHA512
76883b0da915d58ad6dad74e3fac37452b965bc82ba16bd85fb1b092cd4db79feaeebefcb38dd06d63429edc2bd86c457e4c73d202556997a6a0bf3614fa62bd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\cc9bdff952f292fe_0
Filesize
2KB

MD5
6d7db642d31237e707f724de8a571080

SHA1
3ba3b3db316888c4bd0240c6b1f5382cbd87cb81

SHA256
df5653331610b6cb8c814e3296dd9012336d2a778c37301f7b0a25948b74c1a2

SHA512
d9e2e0d70c7fe11834710860a12406adef38cb2ad214e0ddfe1bb68a01678eb6095c99a7a69e8fa0d031e7d8ca2484967f7b7ab4964c83020b1d8f6d0ae7c415

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\d7b7cf01a7bf34ee_0
Filesize
1KB

MD5
85ff5a3d85c83242f81708466a357e68

SHA1
a3b895bb63789847ce7dac47f3d48f019499ab63

SHA256
597bd3070e1ff99a38cf67201aab66190b02db9fbc4d1729619372067a7f902a

SHA512
62d3574851f2120c33e032f42c1092e6811c511a944f81227f48bbee6c293b2c2aa35925f65ec7b8f5f7bdc25d1c24ad8aa7851ac8d3479ad59e45e46d709097

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
e4c65e34f7965fd711f186f21472fd65

SHA1
86bc43512fef627fcad73dbc3fc018f8661d717b

SHA256
e6a99d267770ce2c221c717b0ce3c5a1ad94ca9b4c361109b550095ed379a395

SHA512
f00130989523db5d03fcf9ee415ed4064cee26b5d7122e68d347133c1a56d313cddf8ec56a9b4a8700cbed177171d90dfdffdf4c3895cd3f1cb47e803be6bc73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
5KB

MD5
d1a73bc4dd4b58ec722c9d8bbf07eb25

SHA1
16cfbd36220cd38f1ae773b9722b4855dd3ad56d

SHA256
0ed0fdc98c118cb5d23dcff89b28f47de6a3e6c01b0d769d31b14043d1c7d8d1

SHA512
b8bc25fcf4e3b975dd80ea3b785be994d487aff74301d9bf5a3db2f50c27b120f825f42f1134788b2ef7df360f9aac475bd2f83d5b4900fd4b39f52ccd3fab14

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
6KB

MD5
50fd31444c25c089b6fee60601ff7c55

SHA1
45b41c850692b1a523c9909f16acf1000260ca46

SHA256
05306815586fe43c6445f874ccb012c470c8435934aa5b593bc06164753779a8

SHA512
89590abca30737eeb3dd4e5b20937b580624f575459df02092caff96c84e9499b4338335e4544a6484ba76aae68e9250c8fe4ee9818cb193dfe61590139090ee

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
4KB

MD5
bccca300118934464060e9cb68caab2b

SHA1
2823bd2490e716c6df633b90effb376d53e09f04

SHA256
83a0254f5e96754bd37f6ce5e503d81398fe6a1249f1141a275d52abe1566d15

SHA512
bfb11b3083c75ae143b4cee27fe80044bbbde44aa7df03d2ba01cb0eec2e65a944d5290004017386d6863030ebee5aade44d27cbb0efecf4f55f5d52de0868fe

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
7KB

MD5
1275dd4a2e92b3ae3f8a19e8752c2d42

SHA1
8c8e9eb564cc2faf7794c149c1e4a745525c1755

SHA256
31fd1b918770ecf8da2febc9d5d0cbe18a185f01e7298d054a995638d9e4e7cf

SHA512
a731025740631bd4e48843fcaf2100fc05e089c896811b50ef4bc27a8b19424029d7ec1aa2c904f39d00591b1cb30d3ff2440f48f086f08b30a683378437a4f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
6KB

MD5
a1aec4a4dce0bea167bb698650dbac53

SHA1
272d6e29fc17d87327922e3213d0bebba80bdc99

SHA256
39371e6d1c0ebb908a050ac38c5e393e2d5ed934b899345202f1c7bfcfdb8414

SHA512
6b55fdfede679162fead4ff28829c6906058ca600d538b308b40d0c1fc29b72c5ce5a79302f570b8cec602edc5698619b03232e4cc7fafc0b76e5960b4ad9694

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
6KB

MD5
f80ffe211d1c4c719baa982d14943fc5

SHA1
04ab6fac237226e760fc0262a4be12bc0cbe24ea

SHA256
bece0b12425c21f68254afba8fa1c64ec3d24a9accc262a8850ca353f944545b

SHA512
6bd8b103250ebb3a2e9d31271addecf5cd142c61c7636741f3f9debba1abbe84ae055d23f97b93b8b3854ece7ee0fe4668f8c757ee7982fba685b90c00f3b589

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.reddit.com_0.indexeddb.leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize
23B

MD5
3fd11ff447c1ee23538dc4d9724427a3

SHA1
1335e6f71cc4e3cf7025233523b4760f8893e9c9

SHA256
720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

SHA512
10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
5KB

MD5
fa1b112d3281411ee497da72f55f701f

SHA1
79f7426603b07818a8cd1038f15892006f6d8dde

SHA256
a8b136ae00806c8839a1441438487e4532778dbef52c79d215a338139aa5c0e0

SHA512
5639f8be1c74806a78dfb06237f07a9e5f808bd064ebb65360afd3bd919edff7a0e6a2cda51c6fe822c842eb554d9cb48b638bfbb229b05356f252d7e75acc80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
1KB

MD5
5905b42f2a827bae41cd855cf9fded20

SHA1
b9c57a677baa23eb4689e16bc48999b4487805d4

SHA256
e3164d3cd654af42b4b7a22f62808309a579be99c3c9031f7e9ccfe72db9f7a4

SHA512
ac6e107c674eb46047d96f81c0b50a90dad0e5e2cc81d1dad94dc024e5136db0b81edd2ee4fd8bf8238f2b947bffa0ae18a55c543965444c2a4006604255890a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
5KB

MD5
d21776574bcea7d73e8bb04817cd7c7b

SHA1
3aa57043d71955f65b857d0be6454b3cadf5113e

SHA256
f39726df37117fb4abba4c6f23ec01420d288ac8e33a392c82c95917fcb32a6a

SHA512
0083b6bf36407ad3a11d509c8e363f7283c0f04b2dd878ce542176ef6f32ade740ac4f6aa5e7f7d333b7347e55eb82fb17172b2fdb48cf4740c2d8d9948f8f63

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
5KB

MD5
0afecca0861cad0dc20bee29cf75d367

SHA1
048d250aa6204810dce9e8abe871aecaade091cb

SHA256
765cc424f3067accb554f562b87e47b24b210c7017b87df76ffc167146f158ac

SHA512
c54211967f714f189ac00b7a47e89d4a5ca9ba2962ff3f6a33b95191f2819bc50624f78dab479763399ae9deeb7535811b358ee293aab575533dc63cb4f1bf7a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
5KB

MD5
4484636879a0962e76e9d09f2cc6770f

SHA1
09fc9f58d57ee8cc5e7b6696341a89737de92bac

SHA256
3f5f2310a450cb2d48ee1c50ccd2cee7710caafcc93fbce34131f737dd98d7ea

SHA512
a292fda8d012ead931ae6dfd9630cefac4593837fb232938b48bbccf16c7858b9fd230bbf86cd90eaf9134fa5a5151d68a97107b1cd9ed6151fbc6c46956fbf5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
3KB

MD5
d233684e08eb5b926216ff4ec7d89fea

SHA1
70603c7171c4465d0485553e4a6d6964c760c0b8

SHA256
3ccab396da307e113e8709ff765963d3d918419b1599a253f8ae310b58e62057

SHA512
a4c8200a193bf253ac60f10b123673130ca521e679ba49ae0c0258508dce0d923e7f8ac49730432e3907a1e0fc7df2472e9bb1778634ef1984cf538f31f13476

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
5KB

MD5
4a857ee53064e3ea06a106cf12aed231

SHA1
4f24a00bd5a4c631c7fcc237cc5815d4dfd7763f

SHA256
a76479ba9dcdb9dba10be06f52455a79be6dc85cbca48a9bd4ea32220862cf04

SHA512
14ac6352a8c22894a8e7cafcc106e0bd3102843193661039b71d58ae20ee1a291a1c572c2e5ea0d961fd157d663c05c44169627e05c9511f624928370bb29a7f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
ff710c9f109c900542baed2702d865be

SHA1
ce065292a9f576c6636497fc99367c6994a26606

SHA256
61f5a2a6f7e2ba4ec22a1c63a03da7877e753b8b67f418069cf9aed87e6b7cb0

SHA512
0d9d85dbf940a591ea13f0b8327bbe8cb8e244edbdc1631d0c35d991250461cdff2510c36ec4884440500aa96d75a296e94386a2471802937c140cb79c13e3c8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
2dbfc1f44827c50c5d77f271452ad104

SHA1
0c701145e2e60071a87cde752cc681bc5dde3a33

SHA256
8335e4107ccf1c14c65a27dc09802b3c3554c78beb765a6ead361a59ee9145e3

SHA512
4a7aa178335c335017822c1515a5611f4de8e08be0272397b76425f035e1cfaa5c9c3d6899bec914c37476362ab91f81b768a154cd6e6990aaedcec0a16ebcc8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
2c2d1f99d1974b34ea303756574fcd90

SHA1
632ac835bb1e2665af86cbe5981d533ccafc5db7

SHA256
37cc175b2540a65f38a0cd345bff751ebdc2045815da56a8ef14d3512645899e

SHA512
f73b0208c1b037e22290d411e48ea88d1daa20483da042943cddee99e43d42299f4f4d3192eb590a3bcfbfd3bc1d8acdaffaf6a1896fbe1dfb0fb4909f6c2b9e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
d031f3d98972fe95299310029c37a7b8

SHA1
a448c63d095e2603c9013e309562564802fb5f3c

SHA256
8f487735d2e601d1495b612acd1a5be121dd2d394b6658df2cf41def1959bf5e

SHA512
ffbfe1dd655b7d3a85b6d9cbb5bc3864ef3fd416b6e79bbdac2b56b55af3c49b9740f51162c94298fadfc4b6536b879084405efec89c782cf724799266251214

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
059bc2562f40d37712e66cb7deede88a

SHA1
d8aeac706ca0cbdf531c890eeb86b696535617d8

SHA256
dbf64acd868ef9b698186313800d03e444bc24e225666ff8c3c1801cd33a4b92

SHA512
4c40f3dc26dd3278bdddd30a35d1993cf9f0b95ca74a5f39b5a1c3bf892767ecaa10ae0142b86a5c199c1f70b34e2927ce103ea8487386f0c2215607392b470a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
874B

MD5
2999caeb629a98c09b5fa054fad3d2ae

SHA1
cc1025ee402cc903e519ef11affc64be61e9fdc0

SHA256
31b306155c5d9bf138d59c4b7bca542fbd7b83b4f72c7dfd585b2f4d20a12b3f

SHA512
38bb5e8b045a28a55ac8effd5f9bed891356ab752b83db90b08174fc7f0fcac351db45c3bdbe57ac351a1d54762b1d1605c90712c6c99c8f71d952cd1514ea31

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
805f65de0a6ae1af09cdb4052b60c760

SHA1
403c1bb47a654dbceac552baf60743acadffe374

SHA256
83fc6afe89cfe7d9348435021ff8f98c1d76b47ec58602091c778d9e283614e9

SHA512
3b496956cd0e54d539009f19ed082c9e0a40f2276d48d1a47a4ee6df18a80d0a6ef18d293a1bba44b8359a1720cfc66796f1cc7379cc36c81a4276cde9ea0e70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
fcd1add23088be4e854a4622728e25d7

SHA1
995e5cc6293ca117c2628284707e3ec8e505ec56

SHA256
71033a06152dbce1a2202a1234ed8a2eca877615aad50a630d2e584629a53fc0

SHA512
c92753d8e5ef3a25992928de76c8b65bb3982309cd709c59449710ef7d9353982f238d76eacad572159542021313c56930d7bcb658b5f21aef9e35ea8d01fd58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
d5531a07180eb5950a81720d9daa60da

SHA1
944a4e27034b5b32d63154748406b309fdf87746

SHA256
38de8a3c1449a8f26e0ac8e3b9268f48d22daf9ad7fff9827da2785258e7721a

SHA512
c10ee7a17f7fb5badf9c5466de21d049c24b105898dbcc0d6acb34f0fe20d0c85eb19b8cf3e44bf819eef4ba0b06240d01b9fbfc116e2e6e5fb9250bd4cc37bc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
a6509228b4328f3a5d9b65029c03dfaf

SHA1
78fdadca0afcdb39256f8c02108e7b9a1b389904

SHA256
ad4ae8ee6dbbb1b77e4a939e5ee68c2152c741b8a5c1dd0b36ffb186aa21991a

SHA512
15c146ec67c4394389c14d8c03113c3e4254a9edc51dba82a98b48e2776035c0f1729e601feef2a3ea786000020a7412894d53f1f186a012adab6ad6460a2506

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
f8aef02ddabf915b9829535fd9f4394a

SHA1
6fa7f4e2aaf8b730bd39188c36d2ef9b8a2cf86a

SHA256
0a22131e4b1a399ba9bbc14c73098f07bb71a70b07e7e7c6db9446f227423083

SHA512
20b4682f40cff5d199aefe53e02f78568910efab7a6f92a7a992c3e651fa4fd2decf989b575b96c7ebb7dba68fecd99c333e39a571c56f54d87afe555137598e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
6d8027031859e7a1685ae24b1aff30b5

SHA1
37d2bb4e3a5641fa4e00df56796211eb44b8ebf8

SHA256
aa563a35897d41f0bfddbcc959c977161a1f06d845a1812a5e0e19362f6fecc4

SHA512
4001482f3b817ab9f22c766c224904b90204fb359b6ac91d917ed37b7d2fdd15a557bda0e64640e0b449102cbdc3228f53f72ebd858001713d99385face3dfe8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
6b07354eb15e6eea50aa5dc8ebcf1dd8

SHA1
86a4e81b482fad8e5d9e99a30ad7a69ffc124df7

SHA256
fa91811aa1b56d7b47b04ac7681fd52fd06c5e3b6790f39a7b93baabcc1bbc25

SHA512
feba3387d9f54b3b9207011afa55c7fc0fcb0159642371d17d92f2ace1cb28bc41a6a82b39b0fad083bf775bb3899c3389971bf524b94f101dc74a1448cc8473

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
e3e27f540704d7b860972a4f4cbdf3a8

SHA1
c517b94bb49c08902281670c721ec01702623756

SHA256
57e296f8ac4d6a04c940a2c4ac3fef0388cc8b8cf13dd90239f74f2253988199

SHA512
467c1dbfa8261882eefc912f92d25fbcc4ccb615c5f943a0997aebe66efc6cb6e107de54215330c2a02691c18e40d2776ce628d02393137252ad316fd07f5df0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
63a3d8b4d3f26f7bbddb7f8a8bd3e60d

SHA1
5a5e35c2c8eec3ef537ef7dc93c24467babfdbd5

SHA256
bfd88b36dc0403b40a4371cdb20cb2b033314d5b0e092798c2f66f60403cae5c

SHA512
d961dbc164ec937bf2a3dbb83b92a61e31c9befaa254255cc5373f7d902b6285da7658e8518b2f66631ee47df015a312044657d639a3e6681cd017121f0d087e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
8b532dc513c6638900d0dec48e59b862

SHA1
d1191dc168209fe6eb1b79fa02a288d05a8e9c75

SHA256
d8f664b83b2e8e2e1f68d141f4d8cc9c732e73474082a3527bc7a0f547c25ac5

SHA512
b1be1ad0a0eec1c80c7638e1cbfc8caf4c850d690100a471a03140e4ac9977cea757c1a10ffeca3b99cbf0111a4cf56008560717bb181fa60282fbed5386cdf7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
3b7ab8c4dde4b1e7197f5130e2bb09a3

SHA1
e186fed1acbff5c5069f6c5a6f22b0ccfbebedc9

SHA256
a808ac94735da87e7fd3c993ecb13fb87806925dfab2314845fb0880336d0e7c

SHA512
c3acc143885f4268dbbbbf954e916dec1b7e15805e0ca90a3cb531f280e1ca6093b1f1d92cea4b80d9395a4512c3ae17f3d655413603cfbd62689dd17b015b1f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
155926129c5b5b4e7d480903cdfdd99a

SHA1
62420e52598d470a7b673fd358f7b629d5fffd47

SHA256
0a2d691b6c629e7d698e244edeb41349e10d91417370669f588cfd1f37d0942d

SHA512
3c4c1ecc5b69deb81ea407e06287c1bd0dccbb926e6ca0afdd01925b287b2d522953697aceab8833d7300ec8b48cdd4511e2f11adee135a26a0bf2011c50a4a6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
6cdd7e5177c7a5f27261ac2cac2f39b2

SHA1
df3673186171b78d4417c16258a9606a4d7bd8ef

SHA256
8635affe4b9b65be104379f40e8c021d86199be00df981ab3dbf63673770815a

SHA512
04c3969fb971eeb34ddb5273de93b6c622c317d44b3e6acf40ad56ccca3f9d51487eb89ea4d3f00789a43eb907149c554aafbd4ccea6a0851690801423a9846f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
f95a9d09ef3239da06b67097797326f2

SHA1
f2afd58db76908ebd04bcca969d69f00105e1ff2

SHA256
c7034b25f4e7183196d6718dc4b5553c87008aa9744216a10096335132351be1

SHA512
cac3623a1ad45fa75544e95729a9663f4dc05417be37dbe77511ed8d34211cce41eedb1a092bb452b76f79d08f776268fdc4b07f039ab08cbb609147ef553831

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
4b3ace4683a8517d746d43099386b13c

SHA1
6ef3eb11401cd54030e5405a549096ff06699aae

SHA256
2b23d35686b451d823b3c974aac5aa02be4f5f56cc8ffe64c91dba1bcfad0ba8

SHA512
07b60de457553142427e26a4187f0c730d0c0f8512e881875898dda8a920c77fa79dd70df3bd5eaee5ea1e05109def67d720f257dc0e26536de53b4eace98977

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
10d0a78dd655b0059101a177b96cc53e

SHA1
a67d836cc13be2e167c85a3a1d2915ce2663df86

SHA256
6743e34eb712b695dd729f8fb45a00f8db335a9563ad7c3656632e020e113a17

SHA512
29c73f73c594398c54765c7e7179814e8d8d02decb65c679d02eddf3eaa2c31794fe7ef538d2090dec06983f23e70fde0d7542e8aa2ed04771383bbec5a405ac

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
c00977d34053401f81a75b54b6eb23fc

SHA1
f8b583d5193b65f9ffecde92a7a6142b0615f56a

SHA256
c3d074133d37e130b2c036df83e0dd16a5b58e556c30f0ddd5e934011f043cc3

SHA512
067d07e24ca1fc0565b3ab86aebfe9a82ad79a527c4f147630249a6cf787fd235d139f65e3223e218a19959e0f9966b035c4033340cd294abd3c527a11dfc989

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
40343b56839b57b16ae055741194813d

SHA1
fc9f750750474433c4d24ea840b4d5dbdf1db43c

SHA256
68b5c00465cc43d1c985f8352d6b11259a89778dfedd2adf6872d25779887a60

SHA512
f61e95702cbed150322f543951391a42eef223c10ccb0128ee79af527cc82c19a6626fba8ac307f46376c7c26ac2e74fdc16beadcdcc8dd77947e2b302050574

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
7d8fd82eb55ea8affb84b28f17a81ef4

SHA1
ee2072cd8a6e7057d2f71123db6faf4abd1e29b4

SHA256
ca527c1b1713ab78f1da9ac4f23f5656d0358a7320282e03e96b0326c0571cbe

SHA512
942b5a1f9da29e8a50f35093ca61be9cb0146465cfb81a29183894becc4f93a20081221674911bd83537c24c3c62da1a9438100b8483aee8518234124a0548ce

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
55cc634fe473b38abb2f92624abc1455

SHA1
be17a1110a50400c4890a18f6c3afa83e9649ee5

SHA256
c982007a22f2c4806b9f50d5ab8c053466c7dd7543350e53f261eefbb843b18c

SHA512
d67202ff25de630a7081628be5a23f679ac546e32fc1b4a90a69444315fed507fc46c64cd1778c3df5cec448785a6788c96dd907c992261136bcb05da250dd11

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
8df1c8a401b7bbb0e92e07c0b174ae39

SHA1
3b3fe27cf9e32d800a7d4f08684869a6454ad1e6

SHA256
0bad69a4874c45339cfd414bb7b72d35a894dc536188123682e89e61ed6727ca

SHA512
18d85bca075ddb184c40d1bda68cbf9e56267068ecc3eb2cd015fde79c8cd929e9ef67dc5b37b7df083ae3b99f0169494eadcf855852b524dc8087459af8f1ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
d8535b1221feb6d743bd6c65b1bf293f

SHA1
478a47ea257b89539a7e35ee9929716def1f5357

SHA256
d5a05cecd37348576df5e7e378281066a910d44ba0f91042416863ecbfc3eeb6

SHA512
77c7b7d99464b3be6405dafec6f1bd3b806a1bf29412366aab3369afd3e91ed6150926a864b87bd3317515edefe0139ed2bab7730a331feb1101f546e2952811

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
1KB

MD5
dbdf7d932ff9e75666c1db0c244ad8cd

SHA1
3589a988f17b9143f9151c624014d02002dd67e0

SHA256
123130c377e8291fc89289d8d18b198f479531d4377a1aaa1d1c219e0bd88efe

SHA512
cb8825811c679bf3183e9f8de05ac830f7b29448301cbc1e4b6089236404596a2f479556f8f3fc61513dcad9a1ef9762f59853949eab009bbb6087143b8dce70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
56a338e661e1a05fb3eec8d3a507c142

SHA1
860ce895e1461d5bc6fe7dda782b0aff28c2416c

SHA256
67bcb85db03cd81e911bb1531dc6a034e9ceb2e739371fa4b29a71f0fe0c4a9d

SHA512
fc6c98eb09b07d8fd7483b0706e605ced9310737ad7941203c38f35812cd17683161261534783d3fdc9adc628cfec8913a437eafc3bbb8756d7eb9daee419070

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
f28ccd672080e81449527dff6a632d31

SHA1
4ff50e35eaf1da510623eee73ca3f23beafe4c0a

SHA256
22e6420d9a1f7706eaf2935e7fe5279751f8c968ababbe8c421139ea7d1ace6c

SHA512
7081a6d2e18a1d3a6bb1b3ebc7d264f9ab84dd47aa2ea7c83bfdf8e8b699a39b363649c794c21c9dbb2be74c06542910623c1a525117a0fa783a532939d5b6e1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
0b1c0546feae92922e63024ab7b94735

SHA1
b7498c9dfe2433e981e59adee807df5616432e96

SHA256
1ab850ae20ae8fb38b4fd01bfc472ea3457d6586d68107a7e2484f066860fe5c

SHA512
5e29f5acee2728f22d535e6b2b10da8d09f3a4359607b5d425935df959b6f867186d3aa5f9df9aa97b05c098d983d168693b373d9d083d106d4ccbf1d03acc03

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
6fccf7e9300c2ef4ef6f390202790fc4

SHA1
373e076a7f2d86ac0be3f55215330e0b21a0bf6a

SHA256
14df790466cbd2521d2ca7bf570799160265a6c4ff3bab8d6e5c8d4d58eaed01

SHA512
dcc6bd7ac7af937ab58b2a851e76ccdfe67d860be85924a243774d91038303556af7794abb8300c96d8f9b1b427e5fed43ba02fea909e1a60eddd08c9c878f32

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
21672d610053bc3946a1617157fd3e2d

SHA1
6b3845bb9f7399efce4ea1e58b936dc9c663bb09

SHA256
5d5f7d3610e5e918cbbdd93be08023f153fb3bcacc38ef442f0f6e31bb6d193e

SHA512
ce088ce8b1b240e57862b1db0991659ddbb393c6e28c536730730d63b2df43240c0ac096448e5c45cf72ea138b17212acb3c9064dfec1fce9a90df3d01395baa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
ecf4aa9757a83eed83459ad494d7e618

SHA1
3397074dfed6baaf2299946831ad1c0336a7f847

SHA256
1e6ad5089ed3394e9d424fa0f9dda9ee2f939441d58c659127a130e4921842d8

SHA512
fb01a64eedf0a914be67e895f60ea62f9e9f0091d3e2c00d810e9cea95606d0989012bd119859746cf60e5ef62791c57f0c3c126d6bdfb43a7509c8b4cf43ff7

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
c77f1acfac8fab00f3f136f1eea960e6

SHA1
9833a7c842a14e521d9883fa08e56dc96012458b

SHA256
1090c2ddb812086cb1cf7fc194d9f938912b2cbee215b921970fea25e7698b0c

SHA512
6fc30c422291fa61c8f28edae8e739da08784f68b66db406f7201f5e7e6c767b6e9d2d7ab1cf66bea9169321d70ef756465142ac6ef95c919c287081fe4c558c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
077a6a6f334339167618926f6eff4695

SHA1
a1013d1c6e11a3b941672e60b36145235a2fe566

SHA256
ecc0d7a0ed26b669833c266678477ec3b902fccff9fc4bd624f4a93a07e46d09

SHA512
0e3627a834caee31042185a722f6c4c6b4ccce13dcc5671f94455f14d3593f762821f96525f9360f3a8ed9856e403cfa739afb77a72c946522acd4a4697e837e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
86da6788f1ffd2af8c06530aa00c60bb

SHA1
8b5deb9f9586e3ccfb6c3bbafa585eca4193091a

SHA256
d1afda7035eab592854e407405a360e89022fa1f6891fbc868f844a472f895ff

SHA512
7290906a21c74a0675e22a0d050041996edc39176ce0d23b4fbe51946e67755adbc47e046d085c7543129d87c6c45b57f30e2a8287177e70153b9799e509d771

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
f051b9d1047be15e9efc6d8f3fe788ce

SHA1
b3214b24c3fe2ae1eaf5781df03ffcbb383c599a

SHA256
7dfd33581de9acc39a0a426fd583a6a306b621224eedf015211646d19e9192e8

SHA512
18b2906821cff54569c171fb050b7113fe5ea226d2db6f21b80c9962d25b88de1b34e019bc979a9df137e634fd91ada15114e54864713492a3c16bad75f10cec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
bda00fb9090f3f5edc9afd373255ab83

SHA1
362693930a03a2b550699aa27fc64dd031853e65

SHA256
9d37e774cbfa27a71b652c2b6381286691ffd5bbf149bc4f8da8de098f35fe5f

SHA512
a9e18fe6444663f91f23ec22f05def920c66715eb72314503b4cc3136ddbc2faec12370dd370f9d57c7ea5b57f13b191a80a5170772788884ffd371ad7924fab

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
8KB

MD5
39f4586417bfaf2f00710dc0800a8d88

SHA1
440411bf4c8a12153b20332ba3b1d2ebb39fe244

SHA256
3bd39018f3f648c8a9d6ca699c013e7b324ec4369fd1323e3cf84e6cad522d77

SHA512
0864cb645273f6d3c8331e2b9fe6962fa1d04e066efbdd942c0e2530f07515cd09fc6755d41287e4b5dea4dd662e06b2dd586a69b1e1cf5ba062dde626a99806

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
5dcdf21891872a9c924cdc9bce9e9b90

SHA1
a35a66bc90045e21187507abf4e61507f8468fd8

SHA256
f8130e2976bb02bf80ca1f300b23abcd5b2fb063f931a7a4e8c1ad01e98271e6

SHA512
f11e6bc2e5f3229da96470d1d8fb0deb239f5045dcdd923c48af63bb17ffcddff0763376a7f2891fe947838e75f487481f216d3722ad28a15f0cd19b4fb8b3eb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
c9a10f477cd99074b1ccdd33bea324c5

SHA1
871a6fa7c44d7d90b9797c3dc672afd86117e28b

SHA256
011f364427a29c42d568ac250e7da5b4fbfbc06fa2ff49ed84c9b63d8c191d49

SHA512
89fca1e41c1c71cb1ba2791a2f0101f5bf0a680a8235b2fbbcb20d566c8d38d7bfa326b81b24fa35cfe0dc878c80d3a17cf50f12a74ea504d1991718304cd344

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
6e0dc415dac62933075ee39119c38e1f

SHA1
0870437f136498551223909915a3193232320d93

SHA256
8fac9e2979a8140b9d484f9462dc377eb5a4e7d0f61ddaa52094d9ab9773c163

SHA512
b41b3e09950685f55e1467e21e2e166b4baf89d6e772534c25e5ecbc99a6bbb71e351cb917c03bbc939024da789f0973b8e2cdc3202e92ee1948c12fd1502eeb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
6KB

MD5
71361a1d75ceb7b64d2e7dee57cf639b

SHA1
9b101c8e9636abf07af1d36514ed27000337bc2f

SHA256
efbd87f497b6b33553c3a5b8fe4f2133c3ffa789c34092203f818c9785e6752b

SHA512
0b3bb0ae2045bf465228057fc00f9fbf46ef88a3edffbe4f22d100ec8fd7402b250558eda437aff1682af0ece01ed1df5a79249fd1b089f1976f66ea1041a0f9

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
7KB

MD5
5b7e30ece1f50eb89ad71304813a5301

SHA1
f711971e2d22a6b1e5e24032883d935a9883c06d

SHA256
b2b2b9c8ad0d570c3bc0b14225226203d97222660114e9667f63cdaa45fa3aca

SHA512
a643a47142d8933332bde26f0490d8539296f789274937741f450e2990039a8bfa5cdfd9c575c273bbc6dabd08e95f13d929b3c1ca73e45e919795b3da7a51ff

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
56B

MD5
94275bde03760c160b707ba8806ef545

SHA1
aad8d87b0796de7baca00ab000b2b12a26427859

SHA256
c58cb79fa4a9ade48ed821dd9f98957b0adfda7c2d267e3d07951c2d371aa968

SHA512
2aabd49bc9f0ed3a5c690773f48a92dbbbd60264090a0db2fe0f166f8c20c767a74d1e1d7cc6a46c34cfbd1587ddb565e791d494cd0d2ca375ab8cc11cd8f930

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
120B

MD5
63b8dace939747a927e8f7ea675a03cc

SHA1
3b9fb12f565bdb821aa40b3a5066955ad2e144ce

SHA256
33facf1bc4782da2b6ad561d9d8df8abc2e6e6fb9ac91c0fbac98c108a634fe6

SHA512
92ed0a0671e763b642d386776b68aa93f28cf28965805b3f03f2aa6b761e5ac5f8b94a179bb08bfac50101bc1bbf074abe1578b5e64befc1f542630e0d027d73

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5bd02d.TMP
Filesize
120B

MD5
f434014fde9160677227e047b67bf3b0

SHA1
2f0b3109cfef93aeb4422dce58be416bbe514199

SHA256
9f9a9ff5b20628c4822d59ca59bd63dcab9eee4848da7f9fa8677459934982bd

SHA512
e70884ed11c295e1b4b635a77452412759b6e713b9ae1ca7f55628c1c243b052e24bb6d9f2b0f338d76da0ea1403c20d42c3a555ece4f90550e7bb4829b09d17

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
5cea70d47589dbb9a9366702e4889f4a

SHA1
86c14089193664188af4c894a916a6d5a8f8d58a

SHA256
720eb9577e87bc3c88404fc07ae4b07d72c437f589bc423d89552086c49f1703

SHA512
3f7a5da4b90329dd8587bb6424a7806cc626731ba5c904c22391d49f86388867b7b2db186c8e3ba7808468d1c014217125e591ebfa3719183a6470e37175879d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5ac95c.TMP
Filesize
48B

MD5
45f43ff16905685b593b36689dc8c79e

SHA1
57492a71dae7860282cce83a6e0f135192b77d8f

SHA256
cf9eae0f904489f584121a6e2766d60d8891711296663aea62bbd5d977897421

SHA512
07229b5934d4c4c34867bb42ef1b76f2d951781538c6570a4b2a1aa19b7095bda8540c8f889dccdbf90e5db655a64b7d4e3ba5cd3b9f928aa32a2d68287ae38c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
1045d5ff18d7365a2b550dd783989aba

SHA1
8d7c2ca1705cb03e004d47974b95ff21a9abcc92

SHA256
4a5ff1406a703da2b4fb6ac894e95f9b002d7ea39eb5ef98d801bfdb0c890001

SHA512
487fc2f98d561a9cbda137e04a0ca14d2a43f0e950fa209933e1471274d0512af6a98a6896064ee402c39c5eccbb6f9151335ade523a4d833b8617e64218e930

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
8ca54160415310ee8e0403570441e3c4

SHA1
1d456f770f60bed9077057a85dd4eef02a136472

SHA256
895690e651fdb3b87be88a78916df060e0e76b7b81cc5c08aa5493d232da7a41

SHA512
cfface50f3423d03879fac1197c8a8a8d0bbfdcdef3c811de697300b5d46a9b2673bbad00f478636f329d81079f6e275ac592f91f2ef183e26f468d04b1e0194

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
136KB

MD5
a70f78f3f7c3584286a1e7772850293e

SHA1
802dabeac7ed9974b27b3ceabe96a372b104e42e

SHA256
de3bcde4632cfd89fef2584ab032a717f7deaa08f4114ef68f08113cf67462ec

SHA512
6b7ffc40d46f0974442df3774581a5c3a6609a1fd515786323b497d95fbe9a6cbd6c18289e75967f03ffecacefc089d85e7ce1d7f5b5310d93106527dcb57b56

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
112KB

MD5
3f8cdef1162b1587e45a4601f58b12e9

SHA1
9536badf70500d81b700ed3fe6b12b4754d23e86

SHA256
023b71ea48b6c02c4de7b44c867d1517bdeabcdfefca419567f51d9926f379b7

SHA512
a025b7fb467c13f8afffa76641b0b77bb141dc1ca183352fd720e58ffc418e44154023de931bb7c3c0ebb55eb996eda0b96230a19ca70db564e3f847f58993df

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
116KB

MD5
cb976b57629699c22f7e924886a4e648

SHA1
2e877f9eddf616176543b6125341119ae459019b

SHA256
6f8d8fa9b29ef8315833e714e1727c5b27d7846076ddaa273b469d6c36a50e8d

SHA512
0ed5295988b873c4bd47488b128f94c0b50286a21cdf7b44088655900a30b4c37638e373f525fa7e06f5232ea334a42dbde96c400de4ad72ea8ad804647352f3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
116KB

MD5
fb844700f1d666c5749933e45b7d57c6

SHA1
b0d209dc5d8b47d6e9772147dafafb9ad777f192

SHA256
5409ecabab6d4ed2551c75ae3b37d87b0f0a468d4b74dde73a49691774da9ea5

SHA512
e1ed17ba1cfed2c6046f45726298212940f45d90ee0f7f8bd6a25148ad36e6dcc564a30eed93b19ddfb133ae8175a6d2b2c45b101763bd27de35a2c9bc2e30fb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
111KB

MD5
d57dcf0e573c53950576317eb558c634

SHA1
3f6b6337daed9392024adde4074fe07fd3161f3e

SHA256
3b5cbf3a75c8854423c53467e43f417bb921b5b9e83ddf570e7f92786922802f

SHA512
b428086e299b9b0716b769c85af2b836da9ab83dd1b2db6492a8d1bcec6c12b3cfab3355fa237d40699d95089adb01a2f153f86c2eb5d91248db471fe72f14fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
117KB

MD5
537a77ccdb5d36beaa1f7b88505ea7e1

SHA1
eb99e63846b29f8818a93562f607f3298b311b94

SHA256
1db0563c625edc99bd4ee488228ac9336bb06ee3e4b9f447e3887e0a944bd189

SHA512
2eacb04f50dac670520dafd8283ed4d7d7db397063fb808e3ca84e432f3f13c74755b5ca0c450b322aa74434f67bb4d77bc028155bfda268f2f30e6ea5064a8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
104KB

MD5
9960e934bdf8e480bf4a36aebce23475

SHA1
69bf4c6e3882a085c148b6717d38914a3933c8df

SHA256
efc53e28d013935876ece88565bfe645ad68fd2155b47245535111da6bde5a94

SHA512
da57c04806aa2a140f2d4c20d6de9c0c72fdb4cec630e187077767a24390b01691d3a1870d2bc2d787eded087823fbe95d2bb1eb23f465677fd3bc37aaa35270

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
115KB

MD5
8bb306b86c3907bec58a8b810018bb24

SHA1
da2ae2cc51376f82c665de126334e86fe438a5c2

SHA256
6022b78352edf98b5ebd055707a4fd12a008b5a6a1392db82c7c5e93560fac49

SHA512
76d94fc03b1dc92cfa91770542628940880dd3c9f9c2f34c7f08fc5f43e33f4164deffa515b5783748663e5131220eafd4839ad6afb4fdce4192f3626bd4b67a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
104KB

MD5
4265685ad4df79b11d5e1b5baa4100f8

SHA1
37b6f0c2d8469339dbe7b65084c1fb04e8a6d3d5

SHA256
d685a55f57d216cf127e7731babe5ff4879ff923ff8d3966d6c7f6ebe7327a8e

SHA512
1ef211646b62b4bed9058aff66764c043ebafd574270dc0df2088e545c329e6961501d05a9840092de5a3f7296d7422ef81781b08f12073cc6ca3990b291987c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5aa336.TMP
Filesize
98KB

MD5
8f63992e979d1f2f3d13a7f156d142f3

SHA1
6af008f75bf2da5f3f9e48ce2e22948720ef442b

SHA256
c0725c290070bee44492f8f60e28d43f065b614ea25a7f693e6386712cde47b4

SHA512
721c57e8787196363cec6a155970a284dec0ca76645023b1f1c8c6863d74f882487d4912eaef708d6b6546cbad5a5815042bfb1d63eb9c6bca9dcb0efec81950

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe
Filesize
391KB

MD5
66996a076065ebdcdac85ff9637ceae0

SHA1
4a25632b66a9d30239a1a77c7e7ba81bb3aee9ce

SHA256
16ca09ad70561f413376ad72550ae5664c89c6a76c85c872ffe2cb1e7f49e2aa

SHA512
e42050e799cbee5aa4f60d4e2f42aae656ff98af0548308c8d7f0d681474a9da3ad7e89694670449cdfde30ebe2c47006fbdc57cfb6b357c82731aeebc50901c

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTANM.DLL
Filesize
40KB

MD5
48c00a7493b28139cbf197ccc8d1f9ed

SHA1
a25243b06d4bb83f66b7cd738e79fccf9a02b33b

SHA256
905cb1a15eccaa9b79926ee7cfe3629a6f1c6b24bdd6cea9ccb9ebc9eaa92ff7

SHA512
c0b0a410ded92adc24c0f347a57d37e7465e50310011a9d636c5224d91fbc5d103920ab5ef86f29168e325b189d2f74659f153595df10eef3a9d348bb595d830

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDP2.DLL
Filesize
60KB

MD5
a334bbf5f5a19b3bdb5b7f1703363981

SHA1
6cb50b15c0e7d9401364c0fafeef65774f5d1a2c

SHA256
c33beaba130f8b740dddb9980fe9012f9322ac6e94f36a6aa6086851c51b98de

SHA512
1fa170f643054c0957ed1257c4d7778976c59748670afa877d625aaa006325404bc17c41b47be2906dd3f1e229870d54eb7aba4a412de5adedbd5387e24abf46

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTDPV.DLL
Filesize
64KB

MD5
7c5aefb11e797129c9e90f279fbdf71b

SHA1
cb9d9cbfbebb5aed6810a4e424a295c27520576e

SHA256
394a17150b8774e507b8f368c2c248c10fce50fc43184b744e771f0e79ecafed

SHA512
df59a30704d62fa2d598a5824aa04b4b4298f6192a01d93d437b46c4f907c90a1bad357199c51a62beb87cd724a30af55a619baef9ecf2cba032c5290938022a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTMPX.DLL
Filesize
60KB

MD5
4fbbaac42cf2ecb83543f262973d07c0

SHA1
ab1b302d7cce10443dfc14a2eba528a0431e1718

SHA256
6550582e41fc53b8a7ccdf9ac603216937c6ff2a28e9538610adb7e67d782ab5

SHA512
4146999b4bec85bcd2774ac242cb50797134e5180a3b3df627106cdfa28f61aeea75a7530094a9b408bc9699572cae8cf998108bde51b57a6690d44f0b34b69e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTPSH.DLL
Filesize
36KB

MD5
b4ac608ebf5a8fdefa2d635e83b7c0e8

SHA1
d92a2861d5d1eb67ab434ff2bd0a11029b3bd9a9

SHA256
8414dfe399813b7426c235ba1e625bd2b5635c8140da0d0cfc947f6565fe415f

SHA512
2c42daade24c3ff01c551a223ee183301518357990a9cb2cc2dd7bf411b7059ff8e0bf1d1aee2d268eca58db25902a8048050bdb3cb48ae8be1e4c2631e3d9b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSR.DLL
Filesize
60KB

MD5
9fafb9d0591f2be4c2a846f63d82d301

SHA1
1df97aa4f3722b6695eac457e207a76a6b7457be

SHA256
e78e74c24d468284639faf9dcfdba855f3e4f00b2f26db6b2c491fa51da8916d

SHA512
ac0d97833beec2010f79cb1fbdb370d3a812042957f4643657e15eed714b9117c18339c737d3fd95011f873cda46ae195a5a67ae40ff2a5bcbee54d1007f110a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGENTSVR.EXE
Filesize
268KB

MD5
5c91bf20fe3594b81052d131db798575

SHA1
eab3a7a678528b5b2c60d65b61e475f1b2f45baa

SHA256
e8ce546196b6878a8c34da863a6c8a7e34af18fb9b509d4d36763734efa2d175

SHA512
face50db7025e0eb2e67c4f8ec272413d13491f7438287664593636e3c7e3accaef76c3003a299a1c5873d388b618da9eaede5a675c91f4c1f570b640ac605d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.DLL
Filesize
28KB

MD5
0cbf0f4c9e54d12d34cd1a772ba799e1

SHA1
40e55eb54394d17d2d11ca0089b84e97c19634a7

SHA256
6b0b57e5b27d901f4f106b236c58d0b2551b384531a8f3dad6c06ed4261424b1

SHA512
bfdb6e8387ffbba3b07869cb3e1c8ca0b2d3336aa474bd19a35e4e3a3a90427e49b4b45c09d8873d9954d0f42b525ed18070b949c6047f4e4cdb096f9c5ae5d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT0409.HLP
Filesize
8KB

MD5
466d35e6a22924dd846a043bc7dd94b8

SHA1
35e5b7439e3d49cb9dc57e7ef895a3cd8d80fb10

SHA256
e4ccf06706e68621bb69add3dd88fed82d30ad8778a55907d33f6d093ac16801

SHA512
23b64ed68a8f1df4d942b5a08a6b6296ec5499a13bb48536e8426d9795771dbcef253be738bf6dc7158a5815f8dcc65feb92fadf89ea8054544bb54fc83aa247

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGT20.INF
Filesize
2KB

MD5
e4a499b9e1fe33991dbcfb4e926c8821

SHA1
951d4750b05ea6a63951a7667566467d01cb2d42

SHA256
49e6b848f5a708d161f795157333d7e1c7103455a2f47f50895683ef6a1abe4d

SHA512
a291bb986293197a16f75b2473297286525ac5674c08a92c87b5cc1f0f2e62254ea27d626b30898e7857281bdb502f188c365311c99bda5c2dd76da0c82c554a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTCTL15.TLB
Filesize
28KB

MD5
f1656b80eaae5e5201dcbfbcd3523691

SHA1
6f93d71c210eb59416e31f12e4cc6a0da48de85b

SHA256
3f8adc1e332dd5c252bbcf92bf6079b38a74d360d94979169206db34e6a24cd2

SHA512
e9c216b9725bd419414155cfdd917f998aa41c463bc46a39e0c025aa030bc02a60c28ac00d03643c24472ffe20b8bbb5447c1a55ff07db3a41d6118b647a0003

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\AGTINST.INF
Filesize
7KB

MD5
b127d9187c6dbb1b948053c7c9a6811f

SHA1
b3073c8cad22c87dd9b8f76b6ffd0c4d0a2010d9

SHA256
bd1295d19d010d4866c9d6d87877913eee69e279d4d089e5756ba285f3424e00

SHA512
88e447dd4db40e852d77016cfd24e09063490456c1426a779d33d8a06124569e26597bb1e46a3a2bbf78d9bffee46402c41f0ceb44970d92c69002880ddc0476

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\MSLWVTTS.DLL
Filesize
52KB

MD5
316999655fef30c52c3854751c663996

SHA1
a7862202c3b075bdeb91c5e04fe5ff71907dae59

SHA256
ea4ca740cd60d2c88280ff8115bf354876478ef27e9e676d8b66601b4e900ba0

SHA512
5555673e9863127749fc240f09cf3fb46e2019b459ad198ba1dc356ba321c41e4295b6b2e2d67079421d7e6d2fb33542b81b0c7dae812fe8e1a87ded044edd44

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcirt.dll
Filesize
76KB

MD5
e7cd26405293ee866fefdd715fc8b5e5

SHA1
6326412d0ea86add8355c76f09dfc5e7942f9c11

SHA256
647f7534aaaedffa93534e4cb9b24bfcf91524828ff0364d88973be58139e255

SHA512
1114c5f275ecebd5be330aa53ba24d2e7d38fc20bb3bdfa1b872288783ea87a7464d2ab032b542989dee6263499e4e93ca378f9a7d2260aebccbba7fe7f53999

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Msvcp50.dll
Filesize
552KB

MD5
497fd4a8f5c4fcdaaac1f761a92a366a

SHA1
81617006e93f8a171b2c47581c1d67fac463dc93

SHA256
91cd76f9fa3b25008decb12c005c194bdf66c8d6526a954de7051bec9aae462a

SHA512
73d11a309d8f1a6624520a0bf56d539cb07adee6d46f2049a86919f5ce3556dc031437f797e3296311fe780a8a11a1a37b4a404de337d009e9ed961f75664a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF16.DLL
Filesize
2KB

MD5
7210d5407a2d2f52e851604666403024

SHA1
242fde2a7c6a3eff245f06813a2e1bdcaa9f16d9

SHA256
337d2fb5252fc532b7bf67476b5979d158ca2ac589e49c6810e2e1afebe296af

SHA512
1755a26fa018429aea00ebcc786bb41b0d6c4d26d56cd3b88d886b0c0773d863094797334e72d770635ed29b98d4c8c7f0ec717a23a22adef705a1ccf46b3f68

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\W95INF32.DLL
Filesize
4KB

MD5
4be7661c89897eaa9b28dae290c3922f

SHA1
4c9d25195093fea7c139167f0c5a40e13f3000f2

SHA256
e5e9f7c8dbd47134815e155ed1c7b261805eda6fddea6fa4ea78e0e4fb4f7fb5

SHA512
2035b0d35a5b72f5ea5d5d0d959e8c36fc7ac37def40fa8653c45a49434cbe5e1c73aaf144cbfbefc5f832e362b63d00fc3157ca8a1627c3c1494c13a308fc7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\andmoipa.ttf
Filesize
29KB

MD5
c3e8aeabd1b692a9a6c5246f8dcaa7c9

SHA1
4567ea5044a3cef9cb803210a70866d83535ed31

SHA256
38ae07eeb7909bda291d302848b8fe5f11849cf0d597f0e5b300bfed465aed4e

SHA512
f74218681bd9d526b68876331b22080f30507898b6a6ebdf173490ca84b696f06f4c97f894cb6052e926b1eee4b28264db1ead28f3bc9f627b4569c1ddcd2d3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.dll
Filesize
1.2MB

MD5
ed98e67fa8cc190aad0757cd620e6b77

SHA1
0317b10cdb8ac080ba2919e2c04058f1b6f2f94d

SHA256
e0beb19c3536561f603474e3d5e3c3dff341745d317bc4d1463e2abf182bb18d

SHA512
ec9c3a71ca9324644d4a2d458e9ba86f90deb9137d0a35793e0932c2aa297877ed7f1ab75729fda96690914e047f1336f100b6809cbc7a33baa1391ed588d7f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.hlp
Filesize
11KB

MD5
80d09149ca264c93e7d810aac6411d1d

SHA1
96e8ddc1d257097991f9cc9aaf38c77add3d6118

SHA256
382d745e10944b507a8d9c69ae2e4affd4acf045729a19ac143fa8d9613ccb42

SHA512
8813303cd6559e2cc726921838293377e84f9b5902603dac69d93e217ff3153b82b241d51d15808641b5c4fb99613b83912e9deda9d787b4c8ccfbd6afa56bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tv_enua.inf
Filesize
2KB

MD5
0a250bb34cfa851e3dd1804251c93f25

SHA1
c10e47a593c37dbb7226f65ad490ff65d9c73a34

SHA256
85189df1c141ef5d86c93b1142e65bf03db126d12d24e18b93dd4cc9f3e438ae

SHA512
8e056f4aa718221afab91c4307ff87db611faa51149310d990db296f979842d57c0653cb23d53fea54a69c99c4e5087a2eb37daa794ba62e6f08a8da41255795

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\tvenuax.dll
Filesize
40KB

MD5
1587bf2e99abeeae856f33bf98d3512e

SHA1
aa0f2a25fa5fc9edb4124e9aa906a52eb787bea9

SHA256
c9106198ecbd3a9cab8c2feff07f16d6bb1adfa19550148fc96076f0f28a37b0

SHA512
43161c65f2838aa0e8a9be5f3f73d4a6c78ad8605a6503aae16147a73f63fe985b17c17aedc3a4d0010d5216e04800d749b2625182acc84b905c344f0409765a

Download Submit
C:\Users\Admin\AppData\Local\Temp\KillAgent.bat
Filesize
161B

MD5
ea7df060b402326b4305241f21f39736

SHA1
7d58fb4c58e0edb2ddceef4d21581ff9d512fdc2

SHA256
e4edc2cb6317ab19ee1a6327993e9332af35cfbebaff2ac7c3f71d43cfcbe793

SHA512
3147615add5608d0dce7a8b6efbfb19263c51a2e495df72abb67c6db34f5995a27fde55b5af78bbd5a6468b4065942cad4a4d3cb28ab932aad9b0f835aafe4d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpB366.tmp
Filesize
17.0MB

MD5
ab4df4168f941f5679eb7119ad5173d9

SHA1
318ef17a1e36e7d6ebec03bb05598991a2fb0cd3

SHA256
416a897d88bae305d497c15f33b500882e744e8c8aba47d7613071ff38e5d90f

SHA512
71bcd157a57f8b68cb0d51e1beeeb270be43043516d7de1f0f9914202cbf5011aa65b79c9d7f1eb20e2da052be005000fb3759d79430c8f60fc8333b107c3a27

Download Submit
C:\Users\Admin\Downloads\Teletubisie Setup.exe
Filesize
193KB

MD5
23429d9a1e4d23b1bc1944bee0efa8c5

SHA1
72bb0bb3818f3dd9e2a87689ab9a0627a524a02d

SHA256
2c0646de1c7e826da3390495b27c35baa0b466e63308786c8de14e8855df1f1d

SHA512
a500cafc54eebbd7eae8228148ad825d39a213037b1d4932461be7e49fa0fcd6afbdcfba9fe1d70ae57d5143ce779a4fa0fd3937cd6d4f6c393102d0ecd2b183

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 168182.crdownload
Filesize
8.1MB

MD5
7ee3aeb93b0fa8dc34893e8b3c0f5510

SHA1
faedf76ced4d16de8832d084be985ed8b32cf20d

SHA256
78a7a05316929dddcba6788429eeec08b5428590b89b8d272bd79471f0b6a4d8

SHA512
fba2326c80a69841fa9c97198aa69b0b019fffa591a5f7bd8b38da99f8eb8baa0662c8a4dc751ec38dc7892097175f3b760a7d7e1116aaeeb4b2ffe04b821d29

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 946957.crdownload
Filesize
6.4MB

MD5
9c352d2ce0c0bdc40c72f52ce3480577

SHA1
bd4c956186f33c92eb4469f7e5675510d0790e99

SHA256
d7e6580054525d3f21f86edfc9f30b7a75ffa829a1eb67ee3cab33f0040dba4e

SHA512
c1926d59272df0e049467f4497bcc3631bbc1aa5337e87f4af31bfdba60c9ef460e394380024ffa7e71fef8938761d48d75e9dc93dc7529d2b9c8c638dddae92

Download Submit
C:\Users\Admin\Downloads\avast.vbs
Filesize
41B

MD5
b15b1be9bc8bfb2cd4a09cd1071c0160

SHA1
1be852ad7e1159742815c55a92ab54ef544eaa17

SHA256
17e40f4a0e4b75951e565625fce4aae70d5595b4a0000652f6223e75172af79c

SHA512
bb49e3b42cf581ad43882d78d579d6c846f18c51ccdfd8dfacff450a1d5109df755d7531eabca61e44343a23e46cfbc62fa11d96b3e0c7cd4a9a4c78d70c5eb9

Download Submit
C:\Users\Admin\Downloads\bluelogon.bat
Filesize
4KB

MD5
871246cff38a674126ac2be11d87fefe

SHA1
6b871986db5de07ad1d1be3c24793e3bf74ba9d2

SHA256
adb40217bb86fa2d5ff7053ae8a2b4fe3a3d1c146713a905dd2a7cbdd4a2de29

SHA512
9c056a3d2581b21d827e7f8742bd86d3f8f0af51ea942b4d95f13f0ef9d4e40e28fcdb84b7992199645cbbf415392586c70190e6fddb33ed651bf7cb7b6c718d

Download Submit
C:\Users\Admin\Downloads\bsod.hta
Filesize
1KB

MD5
0814302779986578a2fb3c96206077a9

SHA1
1328a20c393f847817213e12c637b6beecbf0c87

SHA256
ce07f998e0ece87fe3aca6e9c2a3acc1d9e2c4c41f288198bcdeb376d86603c5

SHA512
edc80c4ab118d2005d9fdb98ea36d6785a97511ab8b92eda932358e85c66c296c094aa2ba91507a1ae365b3f5751cbdbfa4f7deb8dc6231c972144b6659e2d13

Download Submit
C:\Users\Admin\Downloads\clutt6.6.6 - by CYBER SOLDIER.rar
Filesize
1.2MB

MD5
60fda8c078bd2c6c8be5246d493afec6

SHA1
339675682e1a9ac2008d5bafd9b49cd3167998dd

SHA256
72d36858e676360cd470943c3a22110324df8e4571c166dc823b09dbefb4017c

SHA512
87298877d1c4fadebd0bf40dd774619f9718eeba4b536dc9eee2abb5bc1809501798152139c47b3db204af119cc52904814c689484b400a00e1ad6e69a58aa00

Download Submit
C:\Users\Admin\Downloads\nokeyboard.reg
Filesize
1KB

MD5
fa5412123f5ef3f83c2bd8b8c23fdf4d

SHA1
5d2a7c634ac64fe9a40fbc217d25178f77c118a9

SHA256
a029ae77eced03e515a2acb0ee8ebecf3aebea402e441beef1615e3488234f8e

SHA512
bdc6d8201b1a334bfd3f204cf4e633f02d024ac693dcb5816f604a885c23f33c1db03dd07378f13d08fa4255fbd642782142a6f7f7f1647b3c26a2c7cd544d54

Download Submit
C:\Users\Admin\Downloads\x.vbs
Filesize
93B

MD5
34e420451be6dc49a1d56fb10cdcb413

SHA1
de858a547d638accdf0c9f22bde9404cc8a6a854

SHA256
ba863eb2faca779c3a7091b6d93da8a3c0c6e28a2600bb7f1dd88b1757d1e043

SHA512
34c3c493bfb9e297840f311a686e32721924e2a5caeec187776ab226932018023e88f2a4165917f9615b3464dba455de30061510e0a289bbde85496272c85ee0

Download Submit
C:\Windows\msagent\AgentCtl.dll
Filesize
160KB

MD5
237e13b95ab37d0141cf0bc585b8db94

SHA1
102c6164c21de1f3e0b7d487dd5dc4c5249e0994

SHA256
d19b6b7c57bcee7239526339e683f62d9c2f9690947d0a446001377f0b56103a

SHA512
9d0a68a806be25d2eeedba8be1acc2542d44ecd8ba4d9d123543d0f7c4732e1e490bad31cad830f788c81395f6b21d5a277c0bed251c9854440a662ac36ac4cb

Download Submit
\??\pipe\crashpad_4384_GJRYSEXZNTAPRDGC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\IXP000.TMP\ADVPACK.DLL
Filesize
73KB

MD5
81e5c8596a7e4e98117f5c5143293020

SHA1
45b7fe0989e2df1b4dfd227f8f3b73b6b7df9081

SHA256
7d126ed85df9705ec4f38bd52a73b621cf64dd87a3e8f9429a569f3f82f74004

SHA512
05b1e9eef13f7c140eb21f6dcb705ee3aaafabe94857aa86252afa4844de231815078a72e63d43725f6074aa5fefe765feb93a6b9cd510ee067291526bb95ec6

Download Submit
memory/3148-2282-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/3760-2357-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/4132-2608-0x000000001B490000-0x000000001B498000-memory.dmp

Filesize
32KB

Download
memory/4316-2679-0x0000000005BB0000-0x00000000060AE000-memory.dmp

Filesize
5.0MB

Download
memory/4316-2678-0x0000000000860000-0x000000000089A000-memory.dmp

Filesize
232KB

Download
memory/4380-3894-0x0000000000BC0000-0x0000000000BDC000-memory.dmp

Filesize
112KB

Download
memory/4800-2605-0x0000000000170000-0x0000000000180000-memory.dmp

Filesize
64KB

Download
memory/4800-2286-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/5924-2854-0x0000000000960000-0x000000000096E000-memory.dmp

Filesize
56KB

Download
memory/6020-2592-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/6080-2234-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/6080-2243-0x00000000749D0000-0x0000000074C08000-memory.dmp

Filesize
2.2MB

Download
memory/6080-2260-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/6188-2316-0x000001FD6FFC0000-0x000001FD6FFE0000-memory.dmp

Filesize
128KB

Download
memory/6188-2289-0x000001FD6F700000-0x000001FD6F800000-memory.dmp

Filesize
1024KB

Download
memory/6188-2294-0x000001FD6FCB0000-0x000001FD6FCD0000-memory.dmp

Filesize
128KB

Download
memory/6744-4621-0x000001EACC600000-0x000001EACCF70000-memory.dmp

Filesize
9.4MB

Download
memory/6744-4620-0x000001EAB1830000-0x000001EAB204C000-memory.dmp

Filesize
8.1MB

Download
memory/6960-2360-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/7156-2276-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/7344-2355-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/7460-2547-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/7868-2262-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/8432-2354-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/8460-2594-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/8508-2337-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/8756-2277-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/9236-2480-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/9584-2364-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/9968-2353-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/10092-2559-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/10160-2607-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/10372-2356-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/10688-2483-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/10828-2361-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/10836-2534-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/11016-2533-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/11024-2479-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/11024-2531-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/11092-2558-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/11180-2613-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/11372-2482-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/11620-2532-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/12000-2502-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/12024-2481-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/12516-4723-0x000000001C3E0000-0x000000001C3EC000-memory.dmp

Filesize
48KB

Download
memory/12516-4722-0x000000001C2E0000-0x000000001C396000-memory.dmp

Filesize
728KB

Download
memory/12544-2591-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/12564-2573-0x00000000767F0000-0x00000000768AD000-memory.dmp

Filesize
756KB

Download
memory/12564-2575-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/13076-2537-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/13488-2578-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/13636-2579-0x0000022680DC0000-0x0000022680DCC000-memory.dmp

Filesize
48KB

Download
memory/13636-2580-0x00000226811B0000-0x00000226811DA000-memory.dmp

Filesize
168KB

Download
memory/13704-2284-0x0000000000520000-0x0000000000530000-memory.dmp

Filesize
64KB

Download
memory/13748-2281-0x00000000045B0000-0x00000000045B1000-memory.dmp

Filesize
4KB

Download
memory/13952-2212-0x00000000767F0000-0x00000000768AD000-memory.dmp

Filesize
756KB

Download
memory/13952-2213-0x00000000749D0000-0x0000000074C08000-memory.dmp

Filesize
2.2MB

Download
memory/13952-2261-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/14008-2593-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/14076-2349-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/14332-2560-0x0000000073AC0000-0x0000000073AC8000-memory.dmp

Filesize
32KB

Download
memory/14412-3316-0x000001FC2A640000-0x000001FC2A7BA000-memory.dmp

Filesize
1.5MB

Download
memory/14412-3315-0x000001FC10120000-0x000001FC1012A000-memory.dmp

Filesize
40KB

Download
memory/14644-3241-0x000000001BBB0000-0x000000001BC4C000-memory.dmp

Filesize
624KB

Download
memory/14644-3237-0x000000001B010000-0x000000001B102000-memory.dmp

Filesize
968KB

Download
memory/14644-3240-0x000000001B5E0000-0x000000001BAAE000-memory.dmp

Filesize
4.8MB

Download
memory/14792-4589-0x0000026808410000-0x0000026808418000-memory.dmp

Filesize
32KB

Download
memory/14792-4590-0x0000026822950000-0x0000026822A26000-memory.dmp

Filesize
856KB

Download
memory/15120-3285-0x0000028839150000-0x0000028839164000-memory.dmp

Filesize
80KB

Download
memory/15120-3286-0x0000028853990000-0x0000028853D6A000-memory.dmp

Filesize
3.9MB

Download
memory/15288-4429-0x000000001B5F0000-0x000000001B6AA000-memory.dmp

Filesize
744KB

Download
memory/15480-5610-0x0000014F6F960000-0x0000014F6F99E000-memory.dmp

Filesize
248KB

Download
memory/15480-5609-0x0000014F6DC60000-0x0000014F6DC84000-memory.dmp

Filesize
144KB

Download
memory/15528-5556-0x000000001BAF0000-0x000000001BDB2000-memory.dmp

Filesize
2.8MB

Download
memory/15528-5557-0x0000000002920000-0x000000000295C000-memory.dmp

Filesize
240KB

Download
memory/16328-5471-0x000000001C3F0000-0x000000001C8FE000-memory.dmp

Filesize
5.1MB

Download