Analysis

  • max time kernel
    62s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20-06-2024 13:47

General

  • Target

    068cd7ee76ccad7b61a72b3a4ce93425_JaffaCakes118.exe

  • Size

    1.5MB

  • MD5

    068cd7ee76ccad7b61a72b3a4ce93425

  • SHA1

    7d3057f6dd1b1ab8dd8de4927e75def2af1ad860

  • SHA256

    2e710d253330193e485d010ab35d2d029f6278d8130a59e4f7aed0653174ffdf

  • SHA512

    94a0b4174476072e30996b27adc02d25dd01e534777ec0ccb7c2d8d5d8362786bea851b6979135119472a4f185d022df39f021bd6d77e3652a8547f6ec7746cc

  • SSDEEP

    49152:jEUccAacQw1j8jeqE7/IsQSr8oKf/2s14/P:YoAaNw1IFsBr7KfN8P

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 56 IoCs
  • Loads dropped DLL 64 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 56 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\068cd7ee76ccad7b61a72b3a4ce93425_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\068cd7ee76ccad7b61a72b3a4ce93425_JaffaCakes118.exe"
    1⤵
    • Loads dropped DLL
    • Writes to the Master Boot Record (MBR)
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:832
    • C:\Windows\SysWOW64\explorer.exe
      explorer C:\Users\Admin\AppData\Local\Temp\068cd7ee76ccad7b61a72b3a4ce93425_JaffaCakes118
      2⤵
        PID:2996
      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
        C:\Windows\system32\XP-AB9DB5FA.EXE
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Writes to the Master Boot Record (MBR)
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2724
        • C:\Windows\SysWOW64\explorer.exe
          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
          3⤵
            PID:2688
          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
            C:\Windows\system32\XP-AB9DB5FA.EXE
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Writes to the Master Boot Record (MBR)
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2912
            • C:\Windows\SysWOW64\explorer.exe
              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
              4⤵
                PID:2692
              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                C:\Windows\system32\XP-AB9DB5FA.EXE
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Writes to the Master Boot Record (MBR)
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2348
                • C:\Windows\SysWOW64\explorer.exe
                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                  5⤵
                    PID:884
                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                    C:\Windows\system32\XP-AB9DB5FA.EXE
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Writes to the Master Boot Record (MBR)
                    • Suspicious use of SetWindowsHookEx
                    • Suspicious use of WriteProcessMemory
                    PID:2340
                    • C:\Windows\SysWOW64\explorer.exe
                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                      6⤵
                        PID:1160
                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                        C:\Windows\system32\XP-AB9DB5FA.EXE
                        6⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Writes to the Master Boot Record (MBR)
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:2768
                        • C:\Windows\SysWOW64\explorer.exe
                          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                          7⤵
                            PID:1168
                          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                            C:\Windows\system32\XP-AB9DB5FA.EXE
                            7⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Writes to the Master Boot Record (MBR)
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:2088
                            • C:\Windows\SysWOW64\explorer.exe
                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                              8⤵
                                PID:2408
                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                8⤵
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Writes to the Master Boot Record (MBR)
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:1544
                                • C:\Windows\SysWOW64\explorer.exe
                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                  9⤵
                                    PID:3012
                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                    9⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Writes to the Master Boot Record (MBR)
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2028
                                    • C:\Windows\SysWOW64\explorer.exe
                                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                      10⤵
                                        PID:2016
                                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                        C:\Windows\system32\XP-AB9DB5FA.EXE
                                        10⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Writes to the Master Boot Record (MBR)
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1752
                                        • C:\Windows\SysWOW64\explorer.exe
                                          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                          11⤵
                                            PID:1696
                                          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                            C:\Windows\system32\XP-AB9DB5FA.EXE
                                            11⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Writes to the Master Boot Record (MBR)
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2544
                                            • C:\Windows\SysWOW64\explorer.exe
                                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                              12⤵
                                                PID:2636
                                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                                12⤵
                                                • Executes dropped EXE
                                                • Writes to the Master Boot Record (MBR)
                                                PID:2796
                                                • C:\Windows\SysWOW64\explorer.exe
                                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                  13⤵
                                                    PID:2448
                                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                                    13⤵
                                                    • Executes dropped EXE
                                                    • Writes to the Master Boot Record (MBR)
                                                    PID:1536
                                                    • C:\Windows\SysWOW64\explorer.exe
                                                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                      14⤵
                                                        PID:2552
                                                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                        C:\Windows\system32\XP-AB9DB5FA.EXE
                                                        14⤵
                                                        • Executes dropped EXE
                                                        • Writes to the Master Boot Record (MBR)
                                                        PID:2396
                                                        • C:\Windows\SysWOW64\explorer.exe
                                                          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                          15⤵
                                                            PID:1996
                                                          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                            C:\Windows\system32\XP-AB9DB5FA.EXE
                                                            15⤵
                                                            • Executes dropped EXE
                                                            • Writes to the Master Boot Record (MBR)
                                                            PID:2820
                                                            • C:\Windows\SysWOW64\explorer.exe
                                                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                              16⤵
                                                                PID:488
                                                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                16⤵
                                                                • Executes dropped EXE
                                                                • Writes to the Master Boot Record (MBR)
                                                                PID:832
                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                  17⤵
                                                                    PID:2400
                                                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                    17⤵
                                                                    • Executes dropped EXE
                                                                    • Writes to the Master Boot Record (MBR)
                                                                    PID:2344
                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                      18⤵
                                                                        PID:564
                                                                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                        C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                        18⤵
                                                                        • Executes dropped EXE
                                                                        • Writes to the Master Boot Record (MBR)
                                                                        PID:2092
                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                          19⤵
                                                                            PID:2916
                                                                          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                            C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                            19⤵
                                                                            • Executes dropped EXE
                                                                            • Writes to the Master Boot Record (MBR)
                                                                            PID:2372
                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                              20⤵
                                                                                PID:2716
                                                                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                20⤵
                                                                                • Executes dropped EXE
                                                                                • Writes to the Master Boot Record (MBR)
                                                                                PID:2636
                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                  21⤵
                                                                                    PID:1848
                                                                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                    21⤵
                                                                                    • Executes dropped EXE
                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                    PID:1756
                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                      22⤵
                                                                                        PID:2812
                                                                                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                        C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                        22⤵
                                                                                        • Executes dropped EXE
                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                        PID:2284
                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                          23⤵
                                                                                            PID:1092
                                                                                          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                            C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                            23⤵
                                                                                            • Executes dropped EXE
                                                                                            • Writes to the Master Boot Record (MBR)
                                                                                            PID:348
                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                              24⤵
                                                                                                PID:2212
                                                                                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                24⤵
                                                                                                • Executes dropped EXE
                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                PID:564
                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                  25⤵
                                                                                                    PID:2732
                                                                                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                    25⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                    PID:1748
                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                      26⤵
                                                                                                        PID:636
                                                                                                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                        C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                        26⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                                        PID:2552
                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                          27⤵
                                                                                                            PID:2724
                                                                                                          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                            C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                            27⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Writes to the Master Boot Record (MBR)
                                                                                                            PID:2348
                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                              28⤵
                                                                                                                PID:1696
                                                                                                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                28⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                                PID:2664
                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                  29⤵
                                                                                                                    PID:2368
                                                                                                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                    29⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                    PID:3032
                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                      30⤵
                                                                                                                        PID:2572
                                                                                                                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                        C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                        30⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                                                        PID:2220
                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                          31⤵
                                                                                                                            PID:2420
                                                                                                                          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                            C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                            31⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Writes to the Master Boot Record (MBR)
                                                                                                                            PID:2496
                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                              32⤵
                                                                                                                                PID:1672
                                                                                                                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                32⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                                                PID:2264
                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                  33⤵
                                                                                                                                    PID:2636
                                                                                                                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                    33⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                    PID:3100
                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                      34⤵
                                                                                                                                        PID:3200
                                                                                                                                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                        C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                        34⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                                                                        PID:3244
                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                          35⤵
                                                                                                                                            PID:3340
                                                                                                                                          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                            C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                            35⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Writes to the Master Boot Record (MBR)
                                                                                                                                            PID:3392
                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                              36⤵
                                                                                                                                                PID:3472
                                                                                                                                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                36⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                                                                PID:3540
                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                  37⤵
                                                                                                                                                    PID:3644
                                                                                                                                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                    37⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                    PID:3692
                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                      38⤵
                                                                                                                                                        PID:3780
                                                                                                                                                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                        C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                        38⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                                                                                        PID:3824
                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                          39⤵
                                                                                                                                                            PID:3920
                                                                                                                                                          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                            C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                            39⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Writes to the Master Boot Record (MBR)
                                                                                                                                                            PID:3968
                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                              40⤵
                                                                                                                                                                PID:4064
                                                                                                                                                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                40⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                                                                                PID:3076
                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                  41⤵
                                                                                                                                                                    PID:3256
                                                                                                                                                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                    41⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                                    PID:3228
                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                      42⤵
                                                                                                                                                                        PID:3104
                                                                                                                                                                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                        C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                        42⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                                                                                                        PID:3568
                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                          43⤵
                                                                                                                                                                            PID:3668
                                                                                                                                                                          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                            C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                            43⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Writes to the Master Boot Record (MBR)
                                                                                                                                                                            PID:3832
                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                              44⤵
                                                                                                                                                                                PID:4000
                                                                                                                                                                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                44⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                PID:4056
                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                  45⤵
                                                                                                                                                                                    PID:3212
                                                                                                                                                                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                    45⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                    PID:3328
                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                      46⤵
                                                                                                                                                                                        PID:3512
                                                                                                                                                                                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                        C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                        46⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                        PID:3448
                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                          47⤵
                                                                                                                                                                                            PID:1004
                                                                                                                                                                                          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                            C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                            47⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                            PID:3988
                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                              48⤵
                                                                                                                                                                                                PID:3100
                                                                                                                                                                                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                48⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                PID:3476
                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                  49⤵
                                                                                                                                                                                                    PID:3948
                                                                                                                                                                                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                    49⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                    PID:3200
                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                        PID:4000
                                                                                                                                                                                                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                        C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                        PID:4104
                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                          51⤵
                                                                                                                                                                                                            PID:4168
                                                                                                                                                                                                          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                            C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                            51⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                            PID:4200
                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                              52⤵
                                                                                                                                                                                                                PID:4296
                                                                                                                                                                                                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                52⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                PID:4332
                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                  53⤵
                                                                                                                                                                                                                    PID:4408
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                    53⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                    PID:4444
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                        PID:4540
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                        C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                        54⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                        PID:4588
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                          55⤵
                                                                                                                                                                                                                            PID:4668
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                            C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                            55⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                            PID:4708
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                              56⤵
                                                                                                                                                                                                                                PID:4796
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                PID:4836
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                  57⤵
                                                                                                                                                                                                                                    PID:4932
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                    57⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:4972
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                        PID:5084
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                        C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                          PID:4120
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                            explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                            59⤵
                                                                                                                                                                                                                                              PID:4340
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                              C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                              59⤵
                                                                                                                                                                                                                                                PID:4320
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                                                    PID:3204
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                      PID:4544
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                                          PID:4860
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                          C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                                                            PID:4796
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                PID:4176
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                62⤵
                                                                                                                                                                                                                                                                  PID:4836
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                    explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                    63⤵
                                                                                                                                                                                                                                                                      PID:4464
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                      C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                      63⤵
                                                                                                                                                                                                                                                                        PID:4604
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                                            PID:1736
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                            C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                            64⤵
                                                                                                                                                                                                                                                                              PID:4544
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                65⤵
                                                                                                                                                                                                                                                                                  PID:4124
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                  C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                  65⤵
                                                                                                                                                                                                                                                                                    PID:2500
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                                                                                                        PID:4980
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                        C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                        66⤵
                                                                                                                                                                                                                                                                                          PID:5132
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                            explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                            67⤵
                                                                                                                                                                                                                                                                                              PID:5196
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                              C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                              67⤵
                                                                                                                                                                                                                                                                                                PID:5232
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                  68⤵
                                                                                                                                                                                                                                                                                                    PID:5328
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                    68⤵
                                                                                                                                                                                                                                                                                                      PID:5372
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                        69⤵
                                                                                                                                                                                                                                                                                                          PID:5448
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                          69⤵
                                                                                                                                                                                                                                                                                                            PID:5496
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                              70⤵
                                                                                                                                                                                                                                                                                                                PID:5580
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                70⤵
                                                                                                                                                                                                                                                                                                                  PID:5616
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                    explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                    71⤵
                                                                                                                                                                                                                                                                                                                      PID:5692
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                      71⤵
                                                                                                                                                                                                                                                                                                                        PID:5740
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                          72⤵
                                                                                                                                                                                                                                                                                                                            PID:5824
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                            72⤵
                                                                                                                                                                                                                                                                                                                              PID:5872
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                73⤵
                                                                                                                                                                                                                                                                                                                                  PID:5948
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                  73⤵
                                                                                                                                                                                                                                                                                                                                    PID:5988
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                      74⤵
                                                                                                                                                                                                                                                                                                                                        PID:6068
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                        74⤵
                                                                                                                                                                                                                                                                                                                                          PID:6116
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                            explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                            75⤵
                                                                                                                                                                                                                                                                                                                                              PID:4332
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                              75⤵
                                                                                                                                                                                                                                                                                                                                                PID:1016
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                  76⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5332
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                    76⤵
                                                                                                                                                                                                                                                                                                                                                      PID:5556
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                        77⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5592
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                          77⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5804
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                              78⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5996
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                78⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5964
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                    explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                    79⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5212
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                      79⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:4980
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                          80⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1096
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                            80⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:5752
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                81⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:6128
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                  81⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5392
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                      82⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:5912
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                        82⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5996
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                            explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                            83⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6168
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                              83⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6216
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:6304
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                    84⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:6344
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                        85⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6436
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                          85⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:6472
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                              86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:6564
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                86⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6604
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                                    87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6680
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                      87⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6724
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                                          88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6820
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                            88⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6856
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                                                89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6936
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6976
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7068
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                        90⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7108
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                                                            91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                              91⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6272
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6408
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                    92⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:928
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6532
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                          93⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6560
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6788
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                94⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:7164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:7112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5064
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:7040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              99⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:7092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    100⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    explorer C:\Windows\SysWOW64\XP-AB9DB5FA
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\XP-AB9DB5FA.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4688
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:2456
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:2152
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:2260
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:1772
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:1952
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:1716
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:288
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:2888
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:2532
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:2172
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            PID:2996
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:2000
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:704
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:2164
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:616
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:1320
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            PID:872
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:2764
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:2980
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:2760
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:1660
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            PID:1528
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:2904
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:2752
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            PID:2304
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:1536
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:2284
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            PID:2084
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            PID:1816
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:880
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:1800
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:3092
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:3236
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:3384
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:3528
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:3684
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            PID:3816
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            PID:3960
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:2220
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:3220
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:3560
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:3788
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:3924
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            PID:2420
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:3556
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:3940
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            PID:3516
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:2572
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:3948
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                                                            PID:4192
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                            PID:4324
                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:4436
                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                                                                              PID:4580
                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:4700
                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:4828
                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:4964
                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:4112
                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:4104
                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:4556
                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:4820
                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:5084
                                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:4120
                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                  PID:4972
                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                    PID:4876
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:5124
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:5224
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:5364
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:5484
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:5608
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                PID:5732
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5864
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:5980
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:6108
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:5296
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5512
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:5684
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                              PID:5976
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5248
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5580
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:5332
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:5804
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:6208
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:6332
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:6464
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:6596
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:6716
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:6848
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:6968
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:7100
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:6232
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:964
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:6656
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6608
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:6860
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:6492
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1664
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:7160
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:6304
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2484

                                                                                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\E_4\RegEx.fnr

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                212KB

                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                6e3ec5fe87effed87d55924a23ca9650

                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                d8f034c7718392b2dcc9f1f5db95897a0541fe77

                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                da5d04c64e050b03787ee0030924b69c6d453e3c25a20dcbbd42d5306d781686

                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                6f81a21db936300441d2e02cbf622214b3f2ec316de6778d78d2223c13690de8fc664c91428ef01275f2992444a2548fcf9225228a0eccde1d1e2beb8793c760

                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\E_4\eAPI.fne

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                316KB

                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                e0225b4ad23c539fa3cf1b27e4ef627c

                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                ce617a0e151f6766cab134b0ab28b7de18fd549f

                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                cdbbaf98e06893a905bfb981a4750696391f9333d01d87b5b0e598f74ec59e17

                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                cb92755473a2df7976e3298d13a46e306a74027e5c87190f48c43858e9b9ba328d63693054dcf34fbedff1a71aa3e95ed4ee4cceab3fd9782a2a0238613f990f

                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\E_4\internet.fne

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                180KB

                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                85c448c7154fe3a00a9e9ddcce9e9e41

                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                d66e6a901e1ac3562fa1fce41cb062f11a9797ab

                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                7c8dbc49ce55b1bc4e770cf5a2f873afbc7a5476fd7f556a0f2204057d1b3ab5

                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                079f8906abb4f90e50125e91f395845679dcaaefa3a2d75b9fe789937591f6d9198a9370228e2e90aaaf995c94661049e3f065a54462ab1d07ac2c79e0abf494

                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\E_4\spec.fne

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                72KB

                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                f479b1f6af04850db6725b5ac697ab6c

                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                12459d253cc6c48ebfb46cdd25eed2467d042eb6

                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                318b07ff4125420e5103f7c144ef5d426164c7d4946b86c1758b1f24631950a0

                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                6ecb2e838404690674e5c3cf90c9eb8008414e0b108733b004f9e11e11c51415ac50fc6353690a465be5e25d97ec45a0544935416675e3d376ec7184d4a2a0ec

                                                                                                                                                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\E_4\com.run

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                264KB

                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                007eb5c8194d1e8e4c30ce6132183a00

                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                dffbed87c6f77a7d1ad5c1830f5d830a87f02453

                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                c32771df076af7b332ac02831ae5a21a0117ff83a72ca91a99efcb00d70f1540

                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                bd45f45c907bba753afea4dfc7fb0a75794cca1bb751f7b8446e6d830c858a1d4c8660a8a07f41554024a6e431a43432383519eab326b0273e1b1ec71398a84b

                                                                                                                                                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\E_4\dp1.fne

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                112KB

                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                a1c93d806f4be79b034092b6191444ca

                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                be806eeca83fcbff3460e6547bfa045a5c67094a

                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                c4277e3123f6d1413f8d605e0ee3ae4c50ef67d4bacebc866938d572ed5373ed

                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                c1e6b6a6f640c0dcc0920d25a0b0a36ad02f9b0f7134966a924615354e5eb3e6914572491ce772621023293bad6cc1a0d392da2bf3dca8178b17d9a714dc2a31

                                                                                                                                                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\E_4\krnln.fnr

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.0MB

                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                c607573928aa8bff7fe6b997f8979da7

                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                6744d3a000177467b5c1e020ac763a4c6f5e8cd7

                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                7cebaf36a296b1d3ad581f6ae04defc186c45c930f284836d8fb81ef63beef91

                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                8ffdfbea84db9cb47cf09183d2c39d102d92c9e88cde2307b0925525043e5a453ab0505b2fdb3aa85e692aaf42cbd2b4a78c168b6c879952b8f3f99632da0112

                                                                                                                                                                                                                                                                                                                                                                                                              • \Users\Admin\AppData\Local\Temp\E_4\shell.fne

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                40KB

                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                d0af2e435bc19d8c75bfe4e5f7488e0a

                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                361c9bab7c187191d7812c0edc564e7236a00ba7

                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                6ea109725c4b51c85abf8ac2f7a22b7206cc5626899f0efdddbf778fd43af458

                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                530208da67a6b452c9acc5d58d70dc729c5aeeb9ba66d6c75b2980f55355dbc31239c7c38c35652b1fd6f70348e937e43f5337c28620cb36f90d39bce2d6a6d0

                                                                                                                                                                                                                                                                                                                                                                                                              • \Windows\SysWOW64\XP-AB9DB5FA.EXE

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.5MB

                                                                                                                                                                                                                                                                                                                                                                                                                MD5

                                                                                                                                                                                                                                                                                                                                                                                                                068cd7ee76ccad7b61a72b3a4ce93425

                                                                                                                                                                                                                                                                                                                                                                                                                SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                7d3057f6dd1b1ab8dd8de4927e75def2af1ad860

                                                                                                                                                                                                                                                                                                                                                                                                                SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                2e710d253330193e485d010ab35d2d029f6278d8130a59e4f7aed0653174ffdf

                                                                                                                                                                                                                                                                                                                                                                                                                SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                94a0b4174476072e30996b27adc02d25dd01e534777ec0ccb7c2d8d5d8362786bea851b6979135119472a4f185d022df39f021bd6d77e3652a8547f6ec7746cc

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/832-0-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/832-139-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/832-31-0x0000000001DA0000-0x0000000001DDF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/832-30-0x0000000001DA0000-0x0000000001DDF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/832-141-0x0000000010000000-0x000000001011C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/832-17-0x00000000003E0000-0x00000000003FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/832-14-0x0000000000370000-0x00000000003BB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/832-11-0x0000000010000000-0x000000001011C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/832-20-0x0000000000560000-0x0000000000571000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1536-232-0x0000000002280000-0x00000000022BF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1536-233-0x0000000002280000-0x00000000022BF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1536-228-0x0000000001CF0000-0x0000000001D0E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1536-229-0x0000000001DD0000-0x0000000001DE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1536-218-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1544-223-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1544-171-0x0000000000480000-0x00000000004BF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1544-224-0x0000000010000000-0x000000001011C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1544-163-0x0000000000350000-0x000000000039B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1544-166-0x0000000000460000-0x0000000000471000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1544-165-0x0000000000440000-0x000000000045E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1544-170-0x0000000000480000-0x00000000004BF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1752-192-0x0000000001D90000-0x0000000001DA1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1752-191-0x00000000003D0000-0x00000000003EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1752-189-0x0000000010000000-0x000000001011C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1752-188-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1752-230-0x0000000010000000-0x000000001011C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1752-190-0x0000000000260000-0x00000000002AB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1752-231-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1752-194-0x0000000002000000-0x000000000203F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/1752-193-0x0000000002000000-0x000000000203F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2028-187-0x0000000000480000-0x00000000004BF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2028-172-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2028-177-0x0000000010000000-0x000000001011C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2028-178-0x0000000000320000-0x000000000036B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2028-226-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2028-180-0x0000000000460000-0x0000000000471000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2028-179-0x0000000000440000-0x000000000045E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2028-186-0x0000000000480000-0x00000000004BF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2028-227-0x0000000010000000-0x000000001011C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2088-154-0x0000000001CB0000-0x0000000001CC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2088-158-0x0000000001FE0000-0x000000000201F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2088-214-0x0000000010000000-0x000000001011C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2088-152-0x0000000001D90000-0x0000000001DDB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2088-213-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2088-144-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2088-153-0x0000000001C90000-0x0000000001CAE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2088-157-0x0000000001FE0000-0x000000000201F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2340-112-0x00000000008A0000-0x00000000008EB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2340-110-0x0000000010000000-0x000000001011C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2340-120-0x0000000001E00000-0x0000000001E3F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2340-116-0x0000000001DB0000-0x0000000001DC1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2340-115-0x0000000001D90000-0x0000000001DAE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2340-121-0x0000000001E00000-0x0000000001E3F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2340-167-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2340-168-0x0000000010000000-0x000000001011C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2348-89-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2348-155-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2348-93-0x0000000001E50000-0x0000000001E9B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2348-94-0x0000000001EA0000-0x0000000001EBE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2348-95-0x0000000001EC0000-0x0000000001ED1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2348-99-0x0000000001F00000-0x0000000001F3F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2348-156-0x0000000010000000-0x000000001011C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2456-54-0x0000000003D10000-0x0000000003D20000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                64KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2544-203-0x00000000005B0000-0x00000000005CE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2544-199-0x0000000010000000-0x000000001011C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2544-238-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2544-207-0x0000000001F50000-0x0000000001F8F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2544-206-0x0000000001F50000-0x0000000001F8F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2544-205-0x00000000001B0000-0x00000000001FB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2544-204-0x0000000001E00000-0x0000000001E11000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2724-52-0x0000000000540000-0x000000000055E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2724-57-0x0000000000820000-0x000000000085F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2724-53-0x0000000000560000-0x0000000000571000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2724-58-0x0000000000820000-0x000000000085F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2724-47-0x0000000000220000-0x000000000026B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2724-44-0x0000000010000000-0x000000001011C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2724-133-0x0000000010000000-0x000000001011C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2724-132-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2724-32-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2768-201-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2768-202-0x0000000010000000-0x000000001011C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2768-137-0x0000000000550000-0x000000000056E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2768-138-0x0000000000570000-0x0000000000581000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2768-143-0x0000000001EB0000-0x0000000001EEF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2768-134-0x00000000002A0000-0x00000000002EB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2768-142-0x0000000001EB0000-0x0000000001EEF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2796-217-0x0000000000700000-0x000000000073F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2796-212-0x0000000000440000-0x000000000048B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2796-216-0x00000000004B0000-0x00000000004C1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2796-215-0x0000000000490000-0x00000000004AE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2912-70-0x0000000010000000-0x000000001011C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2912-60-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2912-76-0x0000000001FE0000-0x0000000001FF1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                68KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2912-151-0x0000000010000000-0x000000001011C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2912-72-0x0000000001E90000-0x0000000001EDB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                300KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2912-75-0x00000000003D0000-0x00000000003EE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                120KB

                                                                                                                                                                                                                                                                                                                                                                                                              • memory/2912-150-0x0000000000400000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                252KB