Analysis

  • max time kernel
    149s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    15-08-2024 13:34

General

  • Target

    eb183cf5d6e217532b203ab9f336e266537828eed01c53158da95d609f4ebea6.exe

  • Size

    1.4MB

  • MD5

    2592d02088ef02e13ad5740fd85ceb17

  • SHA1

    7abba6c521701ae077d7c29f28c87b44d8411922

  • SHA256

    eb183cf5d6e217532b203ab9f336e266537828eed01c53158da95d609f4ebea6

  • SHA512

    50314d33155c066f1cfbb9efac5cfcc9e540c63ff1ccb3c463e6286ee6acac81a09bb1a1b552c2b6243df4ec52aa015ee803900566f1c25f0edfbbe408547310

  • SSDEEP

    24576:IqDEvCTbMWu7rQYlBQcBiT6rprG8arcpZttWJ84kzOS:ITvC/MTQYxsWR7arcPu

Score
7/10

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 1 IoCs
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eb183cf5d6e217532b203ab9f336e266537828eed01c53158da95d609f4ebea6.exe
    "C:\Users\Admin\AppData\Local\Temp\eb183cf5d6e217532b203ab9f336e266537828eed01c53158da95d609f4ebea6.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2092
    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
      "C:\Users\Admin\AppData\Local\Temp\eb183cf5d6e217532b203ab9f336e266537828eed01c53158da95d609f4ebea6.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2232
      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2356
        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2792
          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:2464
            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of WriteProcessMemory
              PID:2768
              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of WriteProcessMemory
                PID:2580
                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                  8⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of WriteProcessMemory
                  PID:2280
                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    • Suspicious use of WriteProcessMemory
                    PID:2900
                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                      10⤵
                      • Executes dropped EXE
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of WriteProcessMemory
                      PID:784
                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SendNotifyMessage
                        • Suspicious use of WriteProcessMemory
                        PID:2132
                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                          12⤵
                          • Executes dropped EXE
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of WriteProcessMemory
                          PID:1528
                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            • Suspicious use of WriteProcessMemory
                            PID:3064
                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                              14⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of FindShellTrayWindow
                              • Suspicious use of SendNotifyMessage
                              • Suspicious use of WriteProcessMemory
                              PID:2276
                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                • Suspicious use of WriteProcessMemory
                                PID:860
                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                  16⤵
                                  • Executes dropped EXE
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  • Suspicious use of WriteProcessMemory
                                  PID:1520
                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Suspicious use of FindShellTrayWindow
                                    • Suspicious use of SendNotifyMessage
                                    PID:964
                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                      18⤵
                                      • Executes dropped EXE
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SendNotifyMessage
                                      PID:1100
                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:1664
                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                          20⤵
                                          • Executes dropped EXE
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          PID:764
                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of FindShellTrayWindow
                                            • Suspicious use of SendNotifyMessage
                                            PID:1492
                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                              22⤵
                                              • Executes dropped EXE
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of FindShellTrayWindow
                                              • Suspicious use of SendNotifyMessage
                                              PID:2076
                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of SendNotifyMessage
                                                PID:2360
                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of FindShellTrayWindow
                                                  • Suspicious use of SendNotifyMessage
                                                  PID:2528
                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of FindShellTrayWindow
                                                    • Suspicious use of SendNotifyMessage
                                                    PID:1496
                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • System Location Discovery: System Language Discovery
                                                      • Suspicious use of FindShellTrayWindow
                                                      • Suspicious use of SendNotifyMessage
                                                      PID:1028
                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        PID:2800
                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                          28⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SendNotifyMessage
                                                          PID:2744
                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of FindShellTrayWindow
                                                            • Suspicious use of SendNotifyMessage
                                                            PID:2608
                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                              30⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of FindShellTrayWindow
                                                              • Suspicious use of SendNotifyMessage
                                                              PID:2592
                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of SendNotifyMessage
                                                                PID:2624
                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                  32⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  • Suspicious use of SendNotifyMessage
                                                                  PID:2916
                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    PID:800
                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                      34⤵
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1824
                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        PID:1160
                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                          36⤵
                                                                          • Executes dropped EXE
                                                                          • System Location Discovery: System Language Discovery
                                                                          PID:2948
                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:2260
                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                              38⤵
                                                                              • Executes dropped EXE
                                                                              PID:2292
                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                PID:444
                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                  40⤵
                                                                                  • Executes dropped EXE
                                                                                  PID:2964
                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:1996
                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                      42⤵
                                                                                      • Executes dropped EXE
                                                                                      PID:904
                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        PID:1344
                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                          44⤵
                                                                                          • Executes dropped EXE
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:2836
                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            PID:536
                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                              46⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:856
                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                PID:2520
                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                  48⤵
                                                                                                  • Executes dropped EXE
                                                                                                  PID:1536
                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    PID:552
                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                      50⤵
                                                                                                      • Executes dropped EXE
                                                                                                      PID:2856
                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        PID:264
                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                          52⤵
                                                                                                          • Executes dropped EXE
                                                                                                          PID:2848
                                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:2748
                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                              54⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:2652
                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:1084
                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                  56⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:344
                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:2484
                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                      58⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:1692
                                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:2880
                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                          60⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          PID:2196
                                                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:396
                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                              62⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:2096
                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                PID:1096
                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                  64⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:1728
                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                    65⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:612
                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                      66⤵
                                                                                                                                        PID:3048
                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                          67⤵
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:464
                                                                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                            68⤵
                                                                                                                                              PID:1580
                                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                69⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:2508
                                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                  70⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:1380
                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                    71⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:2712
                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                      72⤵
                                                                                                                                                        PID:2708
                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                          73⤵
                                                                                                                                                            PID:2616
                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                              74⤵
                                                                                                                                                                PID:2632
                                                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                    PID:2240
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                      76⤵
                                                                                                                                                                        PID:1836
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                          77⤵
                                                                                                                                                                            PID:2648
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                              78⤵
                                                                                                                                                                                PID:1156
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                  79⤵
                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                  PID:2148
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                    80⤵
                                                                                                                                                                                      PID:992
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                        81⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:1924
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                          82⤵
                                                                                                                                                                                            PID:1512
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                              83⤵
                                                                                                                                                                                                PID:2564
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                  84⤵
                                                                                                                                                                                                    PID:2500
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                      85⤵
                                                                                                                                                                                                        PID:700
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                          86⤵
                                                                                                                                                                                                            PID:2156
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                              87⤵
                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                              PID:336
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                88⤵
                                                                                                                                                                                                                  PID:2524
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:2692
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                                        PID:2820
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:2576
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                                              PID:2288
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                                  PID:2868
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                                      PID:2116
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                                                          PID:2668
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                            96⤵
                                                                                                                                                                                                                                              PID:2956
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                                                  PID:900
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                                                      PID:1256
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                                                          PID:3016
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                                                              PID:3056
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                                                  PID:2320
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                                                      PID:2372
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:2540
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                          PID:2740
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                            PID:2844
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                                                PID:1180
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                                                    PID:2024
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                      108⤵
                                                                                                                                                                                                                                                                                        PID:1916
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                                                                            PID:1868
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                              110⤵
                                                                                                                                                                                                                                                                                                PID:2164
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:924
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                                                                      PID:1876
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                        PID:2020
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                                                                            PID:3068
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:1508
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                                                                  PID:1720
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:2860
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                                                                        PID:3004
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                                                                            PID:2804
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                                                                PID:1540
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                                                                    PID:1592
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                      122⤵
                                                                                                                                                                                                                                                                                                                                        PID:2568
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                          123⤵
                                                                                                                                                                                                                                                                                                                                            PID:832
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                                                                                PID:1624
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                  PID:2080
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:1776
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3052
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                          128⤵
                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                          PID:892
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:2384
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1576
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                  131⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:2328
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                      132⤵
                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                      PID:1972
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                        133⤵
                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                        PID:1632
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                          134⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2016
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                              135⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1056
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                  136⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:864
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                      137⤵
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:2760
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1736
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:2556
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2688
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2884
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                PID:928
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1620
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2188
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:772
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2628
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2876
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2452
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2992
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            157⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2908
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              158⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  159⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    160⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      161⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\woolpacks\jailkeeper.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3120

                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Clinton

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              482KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              eb1d1b864ad0ed4efa8d4b52cad77a57

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              cf25a5ee400ee35800602403feefe6890750d2b8

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              3f05521a0f1414f9f21c8108d479de3dad21e1653a4fa340d1cd7a1c0c6d5388

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              ad685f8da8d9fa8d1bd3eadea9d648ccb8c761577bca997dd20d54f8c32805589312d3ff3ca8bcac276762d68478db15a4e02d111876e0be0d200ce191df3155

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\autCEC4.tmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              425KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              7586ea2d22723d5c80e760e7f115905f

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7eec84c9e175cd5708a979a07b15b2308c31ca89

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              8ed2769776974e959a64d8df8958a0f044c50cc0a58cec4310ff65949e78a77b

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              4a7f7d431fc43995b4524f2ab96b8a45a92e8ca8a18ec9e7d0e3cd19cfc8e7d28d9bd87b2e9d9b26c26e2b858930ad40773d630ffff2455c2a74913f6de66ef7

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\autCED4.tmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              9KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              a5a40fc934677f0fdd666bb4d91792fb

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              379dd9be82f137f8f8ca0ef28cbaafc8c13dbac9

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              8089238b137c0839db63e68c3e80eef93bb312c4111d3672145cac4f8a6e350c

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              64cddeb941a39b46f780b30f509fc4993e78a0a74505ad69b3cbb5b75e0299f1387f68c83b35507975d72187cbcbffd82a7e3f389cc3f690b30b140291b99810

                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\nonplacental

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              29KB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              39f11e09f25827416870bd8fb80dae80

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              f2ae6e01c6ea97ec0c8231cb1b1dbcc5bb40b559

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              98639412ce9f24682c61415e01b68edc3ad92ef2f2df8c5ec7a9b6c026ae8061

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              a0e8a9e8353e0849257baa2b205ffc85ce493a3de0d695164deb7bc50ed3906ceeb089e1ce5dce3e34da29a1544d26ff6b92690d1122e0af65e2351456551596

                                                                                                                                                                                                                            • \Users\Admin\AppData\Local\woolpacks\jailkeeper.exe

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                              2592d02088ef02e13ad5740fd85ceb17

                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                              7abba6c521701ae077d7c29f28c87b44d8411922

                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                              eb183cf5d6e217532b203ab9f336e266537828eed01c53158da95d609f4ebea6

                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                              50314d33155c066f1cfbb9efac5cfcc9e540c63ff1ccb3c463e6286ee6acac81a09bb1a1b552c2b6243df4ec52aa015ee803900566f1c25f0edfbbe408547310

                                                                                                                                                                                                                            • memory/2092-11-0x0000000000120000-0x0000000000124000-memory.dmp

                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                              16KB