Analysis
-
max time kernel
230s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 16:44
Static task
static1
Behavioral task
behavioral1
Sample
mem trojan version 2.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
mem trojan version 2.exe
Resource
win10v2004-20240508-en
General
-
Target
mem trojan version 2.exe
-
Size
3.6MB
-
MD5
defe0d7ab04de07169e817c2dead2bd7
-
SHA1
45d76da71d7ab01efbb620476e595a198139e276
-
SHA256
e9702f328464adaa2d7daf2be39bfa6a50b7f06cc536008438fa721779607e8d
-
SHA512
0ac579ba7d2f852f867a10ff861acd554adcf072fcdf00525e8ddc804d99d1d9b513739244092fa4e591fc4928353d81e39b0f604a9f90aca9c59dcfb61d2691
-
SSDEEP
98304:GEn4nJGCgbfnYb/Z6mRV6sSQVwvTPlFc6ZPB:GEn4sTYbsYfSAwr9PB
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation mem trojan version 2.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation WScript.exe -
Executes dropped EXE 53 IoCs
pid Process 3600 cursor.exe 4468 mbr.exe 2568 Project1.exe 3028 TextNew.exe 2044 Ncur.exe 5040 TextNew.exe 4656 GDI.exe 1480 Ncur.exe 956 TextNew.exe 3772 GDI.exe 3324 Ncur.exe 3908 TextNew.exe 2800 GDI.exe 4680 Ncur.exe 2652 TextNew.exe 2304 Ncur.exe 4036 TextNew.exe 4796 Ncur.exe 4084 TextNew.exe 3068 Ncur.exe 4312 TextNew.exe 2012 Ncur.exe 4592 TextNew.exe 3412 Ncur.exe 2588 TextNew.exe 3392 Ncur.exe 1640 TextNew.exe 4532 Ncur.exe 520 TextNew.exe 3268 Ncur.exe 5104 TextNew.exe 3172 Ncur.exe 2276 TextNew.exe 184 Colors_and_invers.exe 2712 SkalaSPAM.exe 3756 Ncur.exe 2152 TextNew.exe 3928 Ncur.exe 1936 TextNew.exe 924 Ncur.exe 4372 TextNew.exe 2264 Ncur.exe 852 TextNew.exe 2940 Ncur.exe 5096 TextNew.exe 3516 Ncur.exe 4952 TextNew.exe 3948 Ncur.exe 3428 TextNew.exe 1380 Ncur.exe 4516 TextNew.exe 4504 Ncur.exe 2532 TextNew.exe -
Loads dropped DLL 50 IoCs
pid Process 3028 TextNew.exe 2044 Ncur.exe 5040 TextNew.exe 4656 GDI.exe 1480 Ncur.exe 956 TextNew.exe 3772 GDI.exe 3324 Ncur.exe 3908 TextNew.exe 2800 GDI.exe 4680 Ncur.exe 2652 TextNew.exe 2304 Ncur.exe 4036 TextNew.exe 4796 Ncur.exe 4084 TextNew.exe 3068 Ncur.exe 4312 TextNew.exe 2012 Ncur.exe 4592 TextNew.exe 3412 Ncur.exe 2588 TextNew.exe 3392 Ncur.exe 1640 TextNew.exe 4532 Ncur.exe 520 TextNew.exe 3268 Ncur.exe 5104 TextNew.exe 3172 Ncur.exe 2276 TextNew.exe 184 Colors_and_invers.exe 2712 SkalaSPAM.exe 3756 Ncur.exe 2152 TextNew.exe 3928 Ncur.exe 1936 TextNew.exe 924 Ncur.exe 4372 TextNew.exe 2264 Ncur.exe 852 TextNew.exe 2940 Ncur.exe 5096 TextNew.exe 3516 Ncur.exe 4952 TextNew.exe 3948 Ncur.exe 3428 TextNew.exe 1380 Ncur.exe 4516 TextNew.exe 4504 Ncur.exe 2532 TextNew.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 mbr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings mem trojan version 2.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings WScript.exe -
Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3304 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4064 taskmgr.exe Token: SeSystemProfilePrivilege 4064 taskmgr.exe Token: SeCreateGlobalPrivilege 4064 taskmgr.exe Token: 33 380 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 380 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe 4064 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2948 wrote to memory of 4896 2948 mem trojan version 2.exe 83 PID 2948 wrote to memory of 4896 2948 mem trojan version 2.exe 83 PID 4896 wrote to memory of 3600 4896 WScript.exe 96 PID 4896 wrote to memory of 3600 4896 WScript.exe 96 PID 4896 wrote to memory of 3600 4896 WScript.exe 96 PID 4896 wrote to memory of 3304 4896 WScript.exe 97 PID 4896 wrote to memory of 3304 4896 WScript.exe 97 PID 4896 wrote to memory of 4468 4896 WScript.exe 98 PID 4896 wrote to memory of 4468 4896 WScript.exe 98 PID 4896 wrote to memory of 4468 4896 WScript.exe 98 PID 4896 wrote to memory of 2568 4896 WScript.exe 105 PID 4896 wrote to memory of 2568 4896 WScript.exe 105 PID 4896 wrote to memory of 2568 4896 WScript.exe 105 PID 4896 wrote to memory of 4852 4896 WScript.exe 106 PID 4896 wrote to memory of 4852 4896 WScript.exe 106 PID 4896 wrote to memory of 3028 4896 WScript.exe 107 PID 4896 wrote to memory of 3028 4896 WScript.exe 107 PID 4896 wrote to memory of 3028 4896 WScript.exe 107 PID 4852 wrote to memory of 2044 4852 WScript.exe 109 PID 4852 wrote to memory of 2044 4852 WScript.exe 109 PID 4852 wrote to memory of 2044 4852 WScript.exe 109 PID 4852 wrote to memory of 5040 4852 WScript.exe 110 PID 4852 wrote to memory of 5040 4852 WScript.exe 110 PID 4852 wrote to memory of 5040 4852 WScript.exe 110 PID 4896 wrote to memory of 4656 4896 WScript.exe 111 PID 4896 wrote to memory of 4656 4896 WScript.exe 111 PID 4896 wrote to memory of 4656 4896 WScript.exe 111 PID 4852 wrote to memory of 1480 4852 WScript.exe 112 PID 4852 wrote to memory of 1480 4852 WScript.exe 112 PID 4852 wrote to memory of 1480 4852 WScript.exe 112 PID 4852 wrote to memory of 956 4852 WScript.exe 113 PID 4852 wrote to memory of 956 4852 WScript.exe 113 PID 4852 wrote to memory of 956 4852 WScript.exe 113 PID 4896 wrote to memory of 3772 4896 WScript.exe 114 PID 4896 wrote to memory of 3772 4896 WScript.exe 114 PID 4896 wrote to memory of 3772 4896 WScript.exe 114 PID 4852 wrote to memory of 3324 4852 WScript.exe 115 PID 4852 wrote to memory of 3324 4852 WScript.exe 115 PID 4852 wrote to memory of 3324 4852 WScript.exe 115 PID 4852 wrote to memory of 3908 4852 WScript.exe 116 PID 4852 wrote to memory of 3908 4852 WScript.exe 116 PID 4852 wrote to memory of 3908 4852 WScript.exe 116 PID 4896 wrote to memory of 2800 4896 WScript.exe 117 PID 4896 wrote to memory of 2800 4896 WScript.exe 117 PID 4896 wrote to memory of 2800 4896 WScript.exe 117 PID 4852 wrote to memory of 4680 4852 WScript.exe 118 PID 4852 wrote to memory of 4680 4852 WScript.exe 118 PID 4852 wrote to memory of 4680 4852 WScript.exe 118 PID 4852 wrote to memory of 2652 4852 WScript.exe 119 PID 4852 wrote to memory of 2652 4852 WScript.exe 119 PID 4852 wrote to memory of 2652 4852 WScript.exe 119 PID 4852 wrote to memory of 2304 4852 WScript.exe 120 PID 4852 wrote to memory of 2304 4852 WScript.exe 120 PID 4852 wrote to memory of 2304 4852 WScript.exe 120 PID 4852 wrote to memory of 4036 4852 WScript.exe 121 PID 4852 wrote to memory of 4036 4852 WScript.exe 121 PID 4852 wrote to memory of 4036 4852 WScript.exe 121 PID 4852 wrote to memory of 4796 4852 WScript.exe 122 PID 4852 wrote to memory of 4796 4852 WScript.exe 122 PID 4852 wrote to memory of 4796 4852 WScript.exe 122 PID 4852 wrote to memory of 4084 4852 WScript.exe 123 PID 4852 wrote to memory of 4084 4852 WScript.exe 123 PID 4852 wrote to memory of 4084 4852 WScript.exe 123 PID 4852 wrote to memory of 3068 4852 WScript.exe 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\mem trojan version 2.exe"C:\Users\Admin\AppData\Local\Temp\mem trojan version 2.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\VBS.vbs"2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\mem2_safe\cursor.exe"C:\mem2_safe\cursor.exe"3⤵
- Executes dropped EXE
PID:3600
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\mem2_safe\notepad.txt3⤵
- Opens file in notepad (likely ransom note)
PID:3304
-
-
C:\mem2_safe\mbr\mbr.exe"C:\mem2_safe\mbr\mbr.exe"3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:4468
-
-
C:\mem2_safe\SoundsDelphi7\Project1.exe"C:\mem2_safe\SoundsDelphi7\Project1.exe"3⤵
- Executes dropped EXE
PID:2568
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\TROLL.VBS"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2044
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5040
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:956
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3324
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3908
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4680
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2652
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2304
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4036
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4796
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4084
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3068
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4312
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4592
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3412
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2588
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3392
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4532
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:520
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3268
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5104
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3172
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3756
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2152
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3928
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1936
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4372
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2940
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5096
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3516
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4952
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3948
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3428
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1380
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4516
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4504
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:4676
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:4044
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:804
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:3116
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:4464
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:2808
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:452
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:768
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:4040
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:5108
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:904
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:620
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:4060
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:1716
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:3992
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:4700
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:2984
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:4860
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:1012
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:3276
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:1896
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:1848
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:4304
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:5164
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:5468
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:5524
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:6104
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:6132
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:6592
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:6636
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:6992
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:7616
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:7736
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:8088
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:8216
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:2844
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:9608
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:9868
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:9488
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:10248
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:11236
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:4552
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:12256
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:11932
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:12980
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:13180
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:13528
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:13752
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:3008
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:1868
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:15248
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:14636
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:6424
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:3604
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:16096
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:16332
-
-
C:\mem2_safe\Ncur.exe"C:\mem2_safe\Ncur.exe"4⤵PID:4396
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"4⤵PID:15712
-
-
-
C:\mem2_safe\TextNew.exe"C:\mem2_safe\TextNew.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4656
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3772
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2800
-
-
C:\mem2_safe\Colors_and_invers.exe"C:\mem2_safe\Colors_and_invers.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:184
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"3⤵PID:4596
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:4408
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"4⤵PID:3168
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:3120
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"4⤵PID:1672
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:2392
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:2308
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:4956
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:5156
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:5704
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:5764
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:5844
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:5900
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:6168
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:6232
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:6368
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:6472
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:7456
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"8⤵PID:7836
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:8052
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"8⤵PID:8140
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:8416
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"8⤵PID:8812
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:7444
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"8⤵PID:7952
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:9628
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"8⤵PID:9860
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:4496
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"8⤵PID:9592
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:10476
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"8⤵PID:10816
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:8208
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"8⤵PID:10988
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:11964
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"8⤵PID:6184
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:11604
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"8⤵PID:12092
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:13156
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"8⤵PID:12472
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:12912
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"8⤵PID:11816
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:13040
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"8⤵PID:12924
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:13888
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"8⤵PID:14276
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:15132
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"8⤵PID:14540
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:15028
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"8⤵PID:5220
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:15688
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"8⤵PID:15876
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:16128
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"8⤵PID:6780
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:15736
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"8⤵PID:7896
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"8⤵PID:7760
-
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:6180
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:6568
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:7364
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:7668
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:7856
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:8312
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:8668
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:9120
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:7952
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:9440
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:9816
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:8208
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:10416
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:10808
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:11132
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:10684
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:11904
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:10408
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:11780
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:12264
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:13228
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:1228
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:13176
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:13540
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:13576
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:14136
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:13668
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:13404
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:15340
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:14592
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:14988
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:5388
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:15516
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:15664
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:15864
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:16084
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:7956
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:7176
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:15924
-
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:5476
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:5956
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:1156
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:5996
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:6796
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:7436
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:7740
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:7896
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:8068
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:8368
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:8732
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:9112
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:9108
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:9564
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:9844
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:10168
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:9456
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:10364
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:10672
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:10972
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:11248
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:11348
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:11588
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:12148
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:12432
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:12584
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:12788
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:13140
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:13504
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:13860
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:14200
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:13648
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:14768
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:15068
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:15232
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:14376
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:5348
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:5220
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:3400
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:15560
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:6908
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:15552
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:7376
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:7980
-
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:6980
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:3584
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:6652
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:7344
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:7300
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:6824
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:7576
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:6956
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:7492
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:8504
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:8916
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:8904
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:9876
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:10192
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:9648
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:9912
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:10880
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:11256
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:10388
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:10852
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:12084
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:11456
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:12040
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:12456
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:13012
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:12460
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:13464
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:13768
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:14332
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:14340
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:14672
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:15012
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:5244
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:3336
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:1652
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:5976
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:16284
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:6064
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:6844
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:7468
-
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:5508
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:5644
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:5716
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:5804
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:5992
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:1468
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:6308
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:6432
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:7252
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:7600
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:7880
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:7984
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:7888
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:8424
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:8768
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:9160
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:8776
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:9424
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:9800
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:10132
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:2196
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:10656
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:10888
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:11260
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:11572
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:11912
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:12236
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:11504
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:12688
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:12956
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:13280
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:12580
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:13908
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:14216
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:13408
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:13580
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:14780
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:15092
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:15256
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:14244
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:1588
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:6480
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:3280
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:15552
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:15432
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:6088
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:7584
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:8036
-
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:1900
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:7332
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:7696
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:7992
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:7260
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:8656
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:8836
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:9136
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:8932
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:9432
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:9884
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:7792
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:11028
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:9708
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:10312
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:11228
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:11888
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:10788
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:11548
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:11764
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:13216
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:12968
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:11404
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:13424
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:13664
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:14084
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:13332
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:14348
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:15240
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:14352
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:14812
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:4872
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:15544
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:15780
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:15944
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:16052
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:7560
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:8168
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:7984
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:16076
-
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:10272
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:10424
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:10824
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:11116
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:10848
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:11448
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:11628
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:12004
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:12336
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:12528
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:12704
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:12964
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:13324
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:13584
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:13896
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:14084
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:4924
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:14500
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:14660
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:14844
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:5740
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:3748
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:4976
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:4892
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:16032
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:16212
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:16376
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:6656
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:8308
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:8636
-
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:5316
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:5492
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:5884
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:6124
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:6564
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:6944
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:7408
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:7640
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:7992
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:8196
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:8708
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:9104
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:8320
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:4824
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:9464
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:9824
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:10136
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:7704
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:2192
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:10760
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:10844
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:11356
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:11596
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:11872
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:9852
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:12488
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:12628
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:12912
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:12736
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:13732
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:13816
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:14000
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:13336
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:14484
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:14852
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:14992
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:14284
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:4120
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:14732
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:15500
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:5976
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:4792
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:7244
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:8000
-
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:6856
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:7124
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:5344
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:7424
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:6784
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:7372
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:7916
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:8392
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:8476
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:8788
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:8988
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:7464
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:10156
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:9220
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:9324
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:2196
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:10800
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:11140
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:10284
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:10916
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:11880
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:12216
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:11660
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:11396
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:408
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:12732
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:2016
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:13576
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:13768
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:14192
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:13540
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:14492
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:14544
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:14904
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:5864
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:5332
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:15680
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:15844
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:16068
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:16240
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:16116
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:15560
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:6292
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:7872
-
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:1560
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"4⤵PID:744
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:1272
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"4⤵PID:4332
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:5544
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:5672
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:5772
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:5856
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:5200
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:6200
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:6260
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:6396
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:6288
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:7568
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:7848
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:8016
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:7868
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:8720
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:9176
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:8184
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:9600
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:9924
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:10228
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:9652
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:10640
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:10896
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:11152
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:10564
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:11540
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:11804
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:12200
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:11816
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:12692
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:12940
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:13240
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:12652
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:13824
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:13988
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:14208
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:1364
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:14788
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:15032
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:15180
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:13556
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:2624
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:5668
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:5012
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:15596
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:15384
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"7⤵PID:6028
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"7⤵PID:7624
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"7⤵PID:15932
-
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:5432
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:4928
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:7352
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:7772
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:7948
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:8440
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:8760
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:9196
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:8908
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:9492
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:9792
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:10176
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:8884
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:10432
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:10904
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:11212
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:5940
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:11580
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:12032
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:11668
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:12720
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:12948
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:13252
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:12592
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:13868
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:14320
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:12580
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:13556
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:14980
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:15264
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:13064
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:5420
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:6460
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:15164
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:15580
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:15756
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:6244
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:7692
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:16084
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:6724
-
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:2164
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:1644
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:5680
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:6008
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:412
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:7196
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:7552
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:7868
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:7844
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:7184
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:8384
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:8784
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:8728
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:7996
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:9352
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:9620
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:10100
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:5176
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:10264
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:10724
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:10760
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:6280
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:11364
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:11604
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:12008
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:11736
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:12352
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:12520
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:12916
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:12844
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:13432
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:13744
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:13632
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:2000
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:14532
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:14800
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:14908
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:5760
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:11836
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:14808
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:15668
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:15900
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:16040
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:16320
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:2412
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:7580
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:8128
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:16320
-
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:6788
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:7036
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:6848
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:7400
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:7660
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:7248
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:8400
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:8744
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:1804
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:4964
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:9168
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:9368
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:8412
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:9904
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:10088
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:4844
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:456
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:10764
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:10936
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:10316
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:10876
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:11848
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:11976
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:12424
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:12524
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:13016
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:12988
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:13600
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:13836
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:14232
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:14152
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:14516
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:14528
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:14848
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:15008
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:5612
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:15720
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:15892
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:16136
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:6724
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:15748
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:7000
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:8284
-
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:5364
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"4⤵PID:5408
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:5536
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"4⤵PID:5660
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:1916
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:1924
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:6248
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:6452
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:6864
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:7388
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:7860
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:8076
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:8136
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:8376
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:8856
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:9128
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:8408
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:9360
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:9664
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:9900
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:1276
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:10256
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:10772
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:11120
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:11340
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:11728
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:12044
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:9824
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:12676
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:12972
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:13168
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:12568
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:13852
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:14096
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:14252
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:13540
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:14736
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:15020
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:15188
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:14276
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:5712
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:4872
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:15424
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:15508
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:3196
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"6⤵PID:15556
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:3288
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"6⤵PID:7500
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"6⤵PID:8352
-
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:1648
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:7308
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:7632
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:7944
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:7152
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:8460
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:8820
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:9152
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:8524
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:9552
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:9836
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:10200
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:10188
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:10356
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:10708
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:11192
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:11196
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:11508
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:11612
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:11864
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:11864
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:12464
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:12616
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:12916
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:12832
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:13512
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:13876
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:14180
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:14396
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:14508
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:14652
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:14836
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:14744
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:5868
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:2696
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:6224
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:15912
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:16200
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:6868
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:7100
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:3248
-
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:2616
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"4⤵PID:1100
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:1996
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"4⤵PID:5616
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:5208
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:6608
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:7540
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:7712
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:7396
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:8124
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:8516
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:8776
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:264
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:9172
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:2584
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:9456
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:9680
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:10108
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:9768
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:3880
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:11084
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:9144
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:10948
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:11416
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:11656
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:11928
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:11644
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:12328
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:12292
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:13032
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:13448
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:13776
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:2724
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:14472
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:14628
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:14896
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:5828
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:3396
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:6120
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:5696
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:16008
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:16160
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"5⤵PID:16344
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"5⤵PID:6664
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"5⤵PID:8472
-
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:6712
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"4⤵PID:6736
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:6828
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"4⤵PID:6924
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:7908
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"4⤵PID:8116
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:8152
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"4⤵PID:6956
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:7652
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"4⤵PID:8432
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:8800
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"4⤵PID:9144
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:8664
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"4⤵PID:9448
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:9892
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"4⤵PID:10184
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:10080
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"4⤵PID:10348
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:10700
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"4⤵PID:11160
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:11376
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"4⤵PID:11840
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:12156
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"4⤵PID:11768
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:12756
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"4⤵PID:13004
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:13204
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"4⤵PID:12832
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:13840
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"4⤵PID:14008
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:14236
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"4⤵PID:13336
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:14724
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"4⤵PID:15000
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:15140
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"4⤵PID:15332
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:4920
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"4⤵PID:6408
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:6660
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"4⤵PID:15568
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:6324
-
-
C:\mem2_safe\GDI.exe"C:\mem2_safe\GDI.exe"4⤵PID:6060
-
-
C:\mem2_safe\SkalaSPAM.exe"C:\mem2_safe\SkalaSPAM.exe"4⤵PID:7664
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\mem2_safe\msg\msg.vbs"4⤵PID:16244
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4064
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x150 0x4941⤵
- Suspicious use of AdjustPrivilegeToken
PID:380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD5cf36079e14c4e4811bcb87d640a89898
SHA1e6000dcc9b2d0c421afeb6440b54dc0f08c832af
SHA2564dbd1e9eb3bf0b5c07db9abfe804833d01148adf3d9c80321c092e19fcd97e97
SHA512e90277098c3ff4910c27296ba0f764e8e9338f3f41270b1f7d3ec20fa0f7bb7491c78f9315ba7885a406de3fc13bf42e0c1e4c6e0a6bd3411ca16f0864169670
-
Filesize
1.4MB
MD5440e9fd9824b8e97d3ca2f34bd1bfbd1
SHA16852b2c592b3794da114d6ac5ea9d083317bf5af
SHA256eddaa890ac6470692f76eee9586c06d727a1caf7a242170ab1a3947523927396
SHA512b458a0838159367727a63e417bba7c12b196f4d4af56703fe77ddcb2c28c3b6aab1d62335c513398f92c225f204e32b437fb49316b7c2b537c1cf877653c2ef8
-
Filesize
27KB
MD574a7754efc8c86b2a00c3fd20b2b435a
SHA1cb4eff972ee734dc71350dc661d428a83855d194
SHA256beba002d937a25aa918809713fc2fbff49c3be3e740c60728a68bae67990d3b7
SHA5127f9ec165120b998e17115c55533672b44182377929c5696ad7045c26e273d55ab3eccf5f9af880567d9e9ef0a09c7584f3a0fac5f96f73c768ff71f6282336df
-
Filesize
158KB
MD559111ac272b84da1b758870d08dd86a8
SHA1133ce08988610004ba326a083eabba5cbb7968b1
SHA256de1a29db4db249c1e6ceb202267676ed7c6204a6e692055cfb6fd530b702fb32
SHA512e7b2310d64cfe3048e123263764b60a2b3244bdf25b10fa800b88fb61994ca8b751741a12579a176dd86913b0804357a96516a1a8c48f7d1eee9aa04cf9daa05
-
Filesize
355KB
MD549d801ccd2b472260cc254794a2e4a95
SHA1b627d2bcd1c17eda08276cf9831d706b8f2ac9a3
SHA2562caf844887fc15db57f3eba19b73eca536c7facad8ae54eb335db7035f059e2c
SHA5124f42459f826180c731fe883ce8f391b311589eba007e60b65252452cd4b4b29950d7bd8ddf7b3b77b07acec5b32c9918c83e5c9e2d6fe8f8e68bf310b2744b55
-
Filesize
178KB
MD59a0e06e6090efea047b76902156c9b6e
SHA19db36556d094c0e7d0355ac300bf4d0f1bef83f7
SHA256e1960b8312094885469a9162aa00cc86873a8b35238dcc132eb95d9e92b9920f
SHA512e4ae251eeff72b01801121a926af2a8c56bab5538149641135959a0a8c6586bea0297445364bc8c6b0ffd0d3546525f8a88be7b84c9c88ac5240182ecb94c0fc
-
Filesize
74KB
MD531eb79ee0d97298b6fff15dbd4236c69
SHA1df41e39a56e091e30faffde50830bb715d4a8a06
SHA2568ba6fb0fae88a4760f4b0b722fecf87a2e73282406635134a8222123be75227e
SHA5125bf916e9b0e93f733f7f4969bdd4c42960a68a9beea62e275e99dae1bb5fa1479b5576cf9e36d28ecae2d90294b9afaf134aa08434b309197ee1aa29a4a577d5
-
Filesize
126KB
MD521758c23e5ff0aceae7368e44afa1078
SHA11e1d4427a3a09b686019966d41519ae8d2916f4b
SHA256d39ca82548e6bcbf57714adb47798633290769fa26a0048109d370c7e18ead39
SHA512b6d7679b5caec55331700cf20cd26b51537e54c0bd24b418d08ae1f1b678728addfa242507ae4008d3e27138de26e4bbf37e5a63786c7c3cbfa03bde371b72a4
-
Filesize
166KB
MD5b1134fcf885ef0dab35fa423ce01a183
SHA11a118238ecb38153b5b2daa8077fbda66a03c53e
SHA25672af3db81c2ff19b974ed4f1d778c458826f8bf32a7e0647b3deaca431c2278e
SHA512e37d8421809113f3954a029ee8ebfefc5e3a7cf53af8fb1fe637e3fe81244557fd1d759414a7650543ad1be42582c2123a605c44d13bdc57d77edf97da746536
-
Filesize
241KB
MD554e7a647d2954e6e61be7d389b7d2fd3
SHA1573bcc7763712f576d328282a3167a0e1b53e82f
SHA25692ea529a2989e7da72b9005f7e5abc787e0436df0fd40300b684575a151842de
SHA5123ae37c64ce88c186e500c1eeee75f2f59d2498966e0064e02b31126e9634db5419b76411508c95345f230c45590167d96cdfba4d56d9c304fac50d4c65180a55
-
Filesize
563KB
MD5cd581ef32009b85a76ce890ef78d318c
SHA197d8dc0b04eab3b662133b272b59c9288beceaee
SHA256aa32355426a6e53092c861fa8c6de72689c4d4c3a3c09a5efcb1289c047f9e7c
SHA512dee5fd128ec6438ad6b3f123d9ef3b9f516e92b2fbbfa0cc8214d65824a371be2e9ec035528a8fbd05c99838a6005eea8d3132baa96f48c0ca0e39d177773ec9
-
Filesize
195KB
MD55ee419581703d5b63e397d41d973f304
SHA17486ad14517a09805e02b7102b72724e839604fa
SHA2562262a1fb54513b50ca2e79590b1fc03818aecc30d7e47e1517096e475aaf1f7c
SHA512bb56a09c4a372c2a58d691cb0a1db67d03c34049fe518b55f557a5d56b7634ddf80bb075008bb9db13ac93d4f456c4153363fc486d72466cb1f98c829b5381b4
-
Filesize
115KB
MD5b2768cf44c1d9bdbea4c67707d427a10
SHA10eb8a7e1216b8980da030dac73361a51978fc63a
SHA256ca09f8ba03c9196f072a70c409954b26603f9d09e08e60b1094c5344d7d513db
SHA512509bbfd03f116292f17c98e72f3ac7fd0aa1035d1bf377e1cd0518c60537d0aadc713162fb54caf75dd29690fda7a5f526cc40df0a2bffb191d415f2870a219f
-
Filesize
126KB
MD52fcd7e2f0fbca4a324ad2383a8ceb86c
SHA1a6f873f16c537130a9b57ad99ce79b38ed82c1f5
SHA25677c2b344560ecdd2d14badb4d4b8f265da506ee0bd1b61c79ab9e7da6bde04f5
SHA512cd9b151a9a2a7a0046999242ae4767a5d175906ddec8d01e9a63cf6106a02a641aab04127194bea961b5e1ad7324aa32c28872bb21f05c9d60fe8b7da72112b0
-
Filesize
138KB
MD564aaf78209be0674b2522dd55501455e
SHA1a426b14d374e359c09baa335963e506a48f8bacd
SHA2564ae0bc6383bac89749b7370ffbcca2cc003a33bcb8bac56362510600297bff62
SHA51293647d875a8185b7ce3aa4d9b1474a9380c92be0001234dbce4135c2b758d95f194aa9a4f58a55a58bf7c377764858a493dd78993315c10e1aac014e441cdac5
-
Filesize
109KB
MD512e6f83020f628a9d8a6ddffe486da8c
SHA18c6b0aa38b0f9211d36b0efda9c76150ce29bd00
SHA256a2bcd2ce7c34b3e753babe2194a92fa6b77b6a5dff00508875052f073416e241
SHA512ff0ad2511cffcfcb38dd8f6943a1eb7a831193d190cdb74c523ec08390044aea6ed33c725147cfe59b4a825951e47016fe9b703189a40ae5fd280c37b38685ca
-
Filesize
138KB
MD51b0fbc289ba16da33a8ed69a273d606e
SHA1f29954c56594d24d225b5c5cf081c7ec0ee6e7fa
SHA256a728e6dd9aaf6b3627b946bfcf022bbee3d340f7cfaf0d17bf3e87677561554c
SHA512cad689e2e285d84a8644468add3e768f8f9de2cffd8e84679218b0483853b7db5298c717b5c91012e48abac325dceb478f7a42fc92b31fc427d7b2646ef7b6d8
-
Filesize
109KB
MD5e677aa0ffc73d3916a1fea8c488174a2
SHA1d0a2ca6075a2f23c6c57ac5054f2ae97e55b0eb9
SHA256302584e896de4741c3f41a38b7f778893bbd75fa599b24a60d1dc9fbebcfd495
SHA5123db4200810d3b7acfb4b38d18a1b82f13d77319917b189ba8a560150087e0c4222a944d4d713fd2085947fe6f7c151408a9f89e8a49504e89e42974099340d96
-
Filesize
247KB
MD5e88849dc970d1d35b8eba0adb0d48610
SHA10145a94d1c67ceba64ff26c46844f03e49564b89
SHA256474fa5cf50ae4e15035366bc2da741439eb69215ada1d1fe9af0eca18d9eb5b9
SHA51267987eaaaf2b95ef9bd408299e51adb92314fc915683eca8708e2479a8d4a642af6e17e37a45bcf68dbe260fb59d36ce417982fce6e3937ecab3bd6ec0256889
-
Filesize
120KB
MD57348481fcd22426728208735b41ead31
SHA194ac04963ab003990ef2d86bd5322ed2bd0a2866
SHA25611b511d217bf11b12c83a0e661bd9c3485d6549fb0c2237fee553fd36e039cc1
SHA51250dec60aa7cf05bdb089a32144589109450d3a3c80fed250b4b02a28a89b4c91395454353add19f248fa4f2576573a671b743bfa5ce966485e60306a6de5aed6
-
Filesize
149B
MD5464124c6b9e6b83fa1918c30522464b6
SHA1c3f5a597a20f2ee62419568ea70d5465750dc223
SHA2567e8499d6c88f36c85b3ff74599e4bace2cc281281b004d5435ce0f986459b972
SHA512a2b09dc1b0143ce2e9bd6df55f85e55f06b132331a7a6ab364a4abf74d2959a312b9f6f5dd63e8cbad00ec026e57b11e90d4d16d470f5cfdfa4c3dff3247d68c
-
Filesize
27KB
MD59aff84c7e6caf21d3ab153ad75d126d3
SHA15a6fbb19468e1c0ab85e1b024907171c0bd21904
SHA256632acd4af5b12a1a27a9288e7bbf8c10def0870e955d92be009c5d5be62cd56d
SHA5127bba84ff8a994a735a67ee15cc7896ea9f3107da2b3ba5005ccb427c4e1915d25d20f0fc666fca5c78d098433d631c8c6199090c7c9d7fab1a63a8a8de5add10
-
Filesize
934B
MD54ab8127d474a0ee5002ca428fcb73b53
SHA14073f0bccb8e79f37d8d33654758f91ea91e9ee1
SHA25643353ffc450566c321b6c0608273a36990d83c533db4db7aa595d1c3aae4e03b
SHA51255aa5950d50cad863e1c0c2fb849e399cba664529b0845a4a4641a3ff5e029875e5b9a467fafe94c7dd5a14983d929b4af62db439b1fbf3b0fa6f3ac6810e3ea
-
Filesize
357KB
MD5482a965caf6576d36b8381a11a0d5423
SHA13e3aca4d5335ba930391599fd76966dc0e58ab50
SHA2560b0045807967625b32d3810fafd5e30cf2190d12c606ce5f9d670bac7e010e90
SHA5125133919021e9c3c8f6271de448c0e33e7e878a40feb8f6293f43e8699cf1b43738b09a18cfa1f66b12b671e3c51da6d54a1b64a118838ee8d8b8babc7df767ea
-
Filesize
47KB
MD5fde57b242d1410f9b259593d6f19d283
SHA1c552597d717891b4f0ae64330f39cc4ef49dfd60
SHA2569bab9bdccc051d62fc30968ef77478cb05f76b1a45db9ea342d4c7d3fd20b0da
SHA51260c67746a0687d94325275916e2b13bd3587b1c6a6f101192b0e1117bd167a4e97b1a614c04cc81b73f0fce9d885f7802949861025df3f8b5ec53a7f10572371
-
Filesize
135B
MD57f66eb5366dff7aef3994d62904aa234
SHA11009846a57a54a0db37c8707445780f1aa2494c7
SHA256630340ddd22d440b997bc79b02035d164f7f0fdb84401f1491c5699d78500996
SHA512a497876df194845f2f1e28acf4f2713a96c420ee8edbcfb9bca6494344f7c3896f741ab1288a5f65efaa7b16d4a5621c407208b250bf75c839ff3f859c0a96b8