9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950b

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/11/2024, 21:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
Size 88KB
Sample241109-1cz7lasfpg
SHA256 9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950b
MD5 b7b14ed9e8e9a0d98339de62134292f0
SHA1 88e87f8f46c7df3a8233746a46c2f3a279e7d9fd
SHA512 1bfbb5e4bcab2c33ab863f2e22e152d131d5124466c719e369247344e27d657f91e5ab704ada3e2e42c3c3df941cd255b2e88dd0ac0b549af7ef0bad6fb97f4d
SSDEEP 768:WWObQBGl1xPlMyWwsXRNTpJjwNH+etvD+TLd0irgrleSTQdtV9x7Quws2cYz52dY:WFl1xPlsXrzKSdtVuskhz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\TsWpfWrp.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\SysWOW64\TsWpfWrp.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\amd64_aspnet_compiler_b03f5f7f11d50a3a_10.0.19041.1_none_9202844cd514ab44\aspnet_compiler.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\msil_addinutil_b77a5c561934e089_10.0.19041.1_none_724c73dbde296e25\AddInUtil.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx35linq-addinprocess_31bf3856ad364e35_10.0.19041.1_none_e688384bec188769\AddInProcess.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\amd64_wcf-comsvcconfig_b03f5f7f11d50a3a_10.0.19041.1_none_3f67a7384812df13\ComSvcConfig.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ServiceModelReg.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\amd64_aspnet_regbrowsers_b03f5f7f11d50a3a_10.0.19041.1_none_82a36c559596820a\aspnet_regbrowsers.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegAsm.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_3.5.19041.1_none_82a6b3679b68b331\MSBuild.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx-ieexec_b03f5f7f11d50a3a_10.0.19041.1_none_6a5de40c0a30489e\IEExec.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\msil_wsatconfig_b03f5f7f11d50a3a_10.0.19041.1_none_c9c647e748814b31\WsatConfig.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\x86_caspol_b03f5f7f11d50a3a_10.0.19041.1_none_2cbf497a80df4629\CasPol.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\x86_addinprocess32_b77a5c561934e089_10.0.19041.1_none_dae2223cd3e6f926\AddInProcess32.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\x86_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.19041.1_none_7e31b18ab29f9913\TsWpfWrp.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx35linq-addinutil_31bf3856ad364e35_10.0.19041.1_none_810f46ab82b9619e\AddInUtil.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\amd64_netfx35linq-edmgen_31bf3856ad364e35_10.0.19041.1_none_646d0595db3c1ad4\EdmGen.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\msil_dfsvc_b03f5f7f11d50a3a_10.0.19041.1_none_26b5e44019fe7ae2\dfsvc.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\msil_jsc_b03f5f7f11d50a3a_10.0.19041.1_none_68bc95ae68779efe\jsc.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\amd64_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_10.0.19041.1_none_da504d0e6afd0a49\TsWpfWrp.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\amd64_addinprocess32_b77a5c561934e089_10.0.19041.1_none_3700bdc08c446a5c\AddInProcess32.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\amd64_wcf-wsatconfig_b03f5f7f11d50a3a_10.0.19041.1_none_c45aa783f860ee61\WsatConfig.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\msil_presentationfontcache_31bf3856ad364e35_10.0.19041.1_none_679d42cd97347ace\PresentationFontCache.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\x86_regasm_b03f5f7f11d50a3a_10.0.19041.1_none_d7fcc21ca684dcb4\RegAsm.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\amd64_msbuild_b03f5f7f11d50a3a_10.0.19041.1_none_fa6e7f402dbc0227\MSBuild.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\amd64_wcf-smsvchost_b03f5f7f11d50a3a_10.0.19200.110_none_11b0c321be81025e\SMSvcHost.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\msil_ieexec_b03f5f7f11d50a3a_10.0.19041.1_none_3fc8ddfd98ad3137\IEExec.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\x86_aspnet_compiler_b03f5f7f11d50a3a_10.0.19041.1_none_d9afbb23e990d44a\aspnet_compiler.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\jsc.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\amd64_caspol_b03f5f7f11d50a3a_10.0.19041.1_none_e51212a36c631d23\CasPol.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\amd64_regsvcs_b03f5f7f11d50a3a_10.0.19041.1_none_636ab5ebe47bac5e\RegSvcs.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\msil_smsvchost_b03f5f7f11d50a3a_10.0.19200.110_none_30a09d63c4775424\SMSvcHost.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\x86_aspnet_regsql_b03f5f7f11d50a3a_10.0.19041.1_none_10c2b4b34d346421\aspnet_regsql.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regsql.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess32.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
File opened for modification	C:\Windows\WinSxS\amd64_aspnet_regsql_b03f5f7f11d50a3a_10.0.19041.1_none_c9157ddc38b83b1b\aspnet_regsql.exe	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 4612	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	86
PID 4548 wrote to memory of 4612	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	86
PID 4612 wrote to memory of 4256	4612	csc.exe	89
PID 4612 wrote to memory of 4256	4612	csc.exe	89
PID 4548 wrote to memory of 2664	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	90
PID 4548 wrote to memory of 2664	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	90
PID 2664 wrote to memory of 4816	2664	csc.exe	92
PID 2664 wrote to memory of 4816	2664	csc.exe	92
PID 4548 wrote to memory of 4492	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	93
PID 4548 wrote to memory of 4492	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	93
PID 4492 wrote to memory of 868	4492	csc.exe	95
PID 4492 wrote to memory of 868	4492	csc.exe	95
PID 4548 wrote to memory of 2380	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	98
PID 4548 wrote to memory of 2380	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	98
PID 2380 wrote to memory of 4772	2380	csc.exe	100
PID 2380 wrote to memory of 4772	2380	csc.exe	100
PID 4548 wrote to memory of 1536	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	101
PID 4548 wrote to memory of 1536	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	101
PID 1536 wrote to memory of 4452	1536	csc.exe	103
PID 1536 wrote to memory of 4452	1536	csc.exe	103
PID 4548 wrote to memory of 2588	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	104
PID 4548 wrote to memory of 2588	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	104
PID 2588 wrote to memory of 3808	2588	csc.exe	106
PID 2588 wrote to memory of 3808	2588	csc.exe	106
PID 4548 wrote to memory of 2864	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	107
PID 4548 wrote to memory of 2864	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	107
PID 2864 wrote to memory of 4836	2864	csc.exe	109
PID 2864 wrote to memory of 4836	2864	csc.exe	109
PID 4548 wrote to memory of 2348	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	110
PID 4548 wrote to memory of 2348	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	110
PID 2348 wrote to memory of 4384	2348	csc.exe	112
PID 2348 wrote to memory of 4384	2348	csc.exe	112
PID 4548 wrote to memory of 5040	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	113
PID 4548 wrote to memory of 5040	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	113
PID 5040 wrote to memory of 3880	5040	csc.exe	116
PID 5040 wrote to memory of 3880	5040	csc.exe	116
PID 4548 wrote to memory of 3920	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	118
PID 4548 wrote to memory of 3920	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	118
PID 3920 wrote to memory of 4260	3920	csc.exe	120
PID 3920 wrote to memory of 4260	3920	csc.exe	120
PID 4548 wrote to memory of 3132	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	121
PID 4548 wrote to memory of 3132	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	121
PID 3132 wrote to memory of 1112	3132	csc.exe	123
PID 3132 wrote to memory of 1112	3132	csc.exe	123
PID 4548 wrote to memory of 2664	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	124
PID 4548 wrote to memory of 2664	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	124
PID 2664 wrote to memory of 5116	2664	csc.exe	126
PID 2664 wrote to memory of 5116	2664	csc.exe	126
PID 4548 wrote to memory of 868	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	127
PID 4548 wrote to memory of 868	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	127
PID 868 wrote to memory of 4808	868	csc.exe	129
PID 868 wrote to memory of 4808	868	csc.exe	129
PID 4548 wrote to memory of 4656	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	130
PID 4548 wrote to memory of 4656	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	130
PID 4656 wrote to memory of 2732	4656	csc.exe	132
PID 4656 wrote to memory of 2732	4656	csc.exe	132
PID 4548 wrote to memory of 1440	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	133
PID 4548 wrote to memory of 1440	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	133
PID 1440 wrote to memory of 4024	1440	csc.exe	135
PID 1440 wrote to memory of 4024	1440	csc.exe	135
PID 4548 wrote to memory of 3060	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	136
PID 4548 wrote to memory of 3060	4548	9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe	136
PID 3060 wrote to memory of 4456	3060	csc.exe	138
PID 3060 wrote to memory of 4456	3060	csc.exe	138

C:\Users\Admin\AppData\Local\Temp\9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe
"C:\Users\Admin\AppData\Local\Temp\9edb7f1f6cc45aa4cd5dadaf1c11afb7bffada67bfe8467f302e11af106b950bN.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\chbidxgu.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8FAE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC8FAD.tmp"
    3⤵
    PID:4256
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g4hubtci.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9953.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9942.tmp"
    3⤵
    PID:4816
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zfbnnf44.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9A8B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9A8A.tmp"
    3⤵
    PID:868
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gaa6ufsc.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9B37.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9B27.tmp"
    3⤵
    PID:4772
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sdoqw4kn.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9BD3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9BD2.tmp"
    3⤵
    PID:4452
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ouwtgchh.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9C41.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9C40.tmp"
    3⤵
    PID:3808
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wavbl9t-.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9CFC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9CFB.tmp"
    3⤵
    PID:4836
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b9gvqqbl.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D99.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9D98.tmp"
    3⤵
    PID:4384
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jxglmixt.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9EA2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC9EA1.tmp"
    3⤵
    PID:3880
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\shj0ldtc.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA1DE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA1DD.tmp"
    3⤵
    PID:4260
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b6cqgytt.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3132
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA23C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA23B.tmp"
    3⤵
    PID:1112
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vjmoojrl.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA2A9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA2A8.tmp"
    3⤵
    PID:5116
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jw86rjsh.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA384.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA383.tmp"
    3⤵
    PID:4808
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jxexkll-.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA47E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA47D.tmp"
    3⤵
    PID:2732
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vgcxmg6l.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1440
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA4EC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA4EB.tmp"
    3⤵
    PID:4024
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xfgrgdyw.cmdline"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA549.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA548.tmp"
    3⤵
    PID:4456
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i2hrrzlp.cmdline"
  2⤵
  PID:2588
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA5B7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA5B6.tmp"
    3⤵
    PID:2064
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\sz-4fpyh.cmdline"
  2⤵
  PID:4936
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA624.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA623.tmp"
    3⤵
    PID:860
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ijm-xmvm.cmdline"
  2⤵
  PID:4388
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA682.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA681.tmp"
    3⤵
    PID:2228
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2ywrx5xa.cmdline"
  2⤵
  PID:3756
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA6D0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA6CF.tmp"
    3⤵
    PID:2856
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dnqgmbku.cmdline"
  2⤵
  PID:4724
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA74D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA74C.tmp"
    3⤵
    PID:116
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bke9m7xw.cmdline"
  2⤵
  PID:1444
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA7BA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA7B9.tmp"
    3⤵
    PID:4924
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\drvgaaxm.cmdline"
  2⤵
  PID:4792
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA857.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA856.tmp"
    3⤵
    PID:4796
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bof2rbdi.cmdline"
  2⤵
  PID:4980
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA8C4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA8C3.tmp"
    3⤵
    PID:2032
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ytuy6iuh.cmdline"
  2⤵
  PID:5116
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA941.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA940.tmp"
    3⤵
    PID:1004
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\u2_wd3mb.cmdline"
  2⤵
  PID:1796
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA99F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA99E.tmp"
    3⤵
    PID:868
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\8-fwoixw.cmdline"
  2⤵
  PID:1376
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAAE7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAAE6.tmp"
    3⤵
    PID:404
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\muzrj9sr.cmdline"
  2⤵
  PID:4452
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB54.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAB53.tmp"
    3⤵
    PID:2652
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\y-ig3r4p.cmdline"
  2⤵
  PID:2808
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESABD1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCABD0.tmp"
    3⤵
    PID:1120
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yuexshue.cmdline"
  2⤵
  PID:3272
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAC3F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAC3E.tmp"
    3⤵
    PID:1152
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uw-7s0ab.cmdline"
  2⤵
  PID:1472
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESACAC.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCACAB.tmp"
    3⤵
    PID:3064
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jcdywwxk.cmdline"
  2⤵
  PID:3288
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD77.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAD76.tmp"
    3⤵
    PID:4856
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\a29ruuqf.cmdline"
  2⤵
  PID:4596
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESADD5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCADD4.tmp"
    3⤵
    PID:3948
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k4tkcgzs.cmdline"
  2⤵
  PID:4252
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAE33.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAE32.tmp"
    3⤵
    PID:4924
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tcjd3t7m.cmdline"
  2⤵
  PID:3776
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAEA0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAE9F.tmp"
    3⤵
    PID:1112
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fyhxjpq7.cmdline"
  2⤵
  PID:4960
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAEFE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAEFD.tmp"
    3⤵
    PID:1996
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qzcnfyzw.cmdline"
  2⤵
  PID:3132
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAF5B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAF5A.tmp"
    3⤵
    PID:4576
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\khut94x5.cmdline"
  2⤵
  PID:3504
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAFC9.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCAFC8.tmp"
    3⤵
    PID:1604
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jrm-unxd.cmdline"
  2⤵
  PID:1552
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB036.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB035.tmp"
    3⤵
    PID:3812
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\il1kz2ne.cmdline"
  2⤵
  PID:4412
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB0A4.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB0A3.tmp"
    3⤵
    PID:2696
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\guuo3_0u.cmdline"
  2⤵
  PID:4720
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB111.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB110.tmp"
    3⤵
    PID:4584
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zl96kbxu.cmdline"
  2⤵
  PID:2808
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB15F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB15E.tmp"
    3⤵
    PID:1732
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x-k56ijh.cmdline"
  2⤵
  PID:3980
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB2B7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB2B6.tmp"
    3⤵
    PID:1296
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\inxvwfii.cmdline"
  2⤵
  PID:408
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB324.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB314.tmp"
    3⤵
    PID:3636
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fe0r0esx.cmdline"
  2⤵
  PID:4856
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB392.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB391.tmp"
    3⤵
    PID:1816
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eg1b99di.cmdline"
  2⤵
  PID:2404
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB3EF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB3EE.tmp"
    3⤵
    PID:2272
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\eyu44wxa.cmdline"
  2⤵
  PID:5072
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB45D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB45C.tmp"
    3⤵
    PID:3844
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\waxadswp.cmdline"
  2⤵
  PID:1096
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB4CA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB4C9.tmp"
    3⤵
    PID:1940
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tta9nguv.cmdline"
  2⤵
  PID:1996
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB537.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB536.tmp"
    3⤵
    PID:4440
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s_2oxhiq.cmdline"
  2⤵
  PID:4576
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB5A5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB5A4.tmp"
    3⤵
    PID:1028
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i9waqt7m.cmdline"
  2⤵
  PID:4492
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB622.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB621.tmp"
    3⤵
    PID:4408
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\in0zzyrf.cmdline"
  2⤵
  PID:1944
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB680.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB66F.tmp"
    3⤵
    PID:1376
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hfxujxkc.cmdline"
  2⤵
  PID:4452
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB6DD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB6DC.tmp"
    3⤵
    PID:1600
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gxcqwjgs.cmdline"
  2⤵
  PID:384
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB74B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCB74A.tmp"
    3⤵
    PID:1724
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vmsni8_w.cmdline"
  2⤵
  PID:3980
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBC9A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBC99.tmp"
    3⤵
    PID:2592
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tdbt7pcc.cmdline"
  2⤵
  PID:3676
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC15D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC15C.tmp"
    3⤵
    PID:4856
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fkwj2zuz.cmdline"
  2⤵
  PID:3252
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC9E8.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC9E7.tmp"
    3⤵
    PID:4400
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uhavs7vj.cmdline"
  2⤵
  PID:4260
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCA65.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCA64.tmp"
    3⤵
    PID:412
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tv5i8qn0.cmdline"
  2⤵
  PID:1112
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCAC3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCAB2.tmp"
    3⤵
    PID:2340
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s4sccqgt.cmdline"
  2⤵
  PID:2200
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCB21.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCB20.tmp"
    3⤵
    PID:3092
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uutsvhge.cmdline"
  2⤵
  PID:3132
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCB8E.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCCB8D.tmp"
    3⤵
    PID:4784
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hapro6j0.cmdline"
  2⤵
  PID:1608
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD206.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCD205.tmp"
    3⤵
    PID:3728
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\glks9rh0.cmdline"
  2⤵
  PID:740
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFA20.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFA1F.tmp"
    3⤵
    PID:1732
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bluzmi91.cmdline"
  2⤵
  PID:860
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFA9D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFA8C.tmp"
    3⤵
    PID:2412
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ylrh7uge.cmdline"
  2⤵
  PID:3428
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFBA7.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFBA6.tmp"
    3⤵
    PID:4836
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\44ejb5yt.cmdline"
  2⤵
  PID:3312
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFC04.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFC03.tmp"
    3⤵
    PID:4976
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rni6dpo2.cmdline"
  2⤵
  PID:116
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFC62.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFC61.tmp"
    3⤵
    PID:3408
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fhlao1hs.cmdline"
  2⤵
  PID:2488
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFCDF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFCDE.tmp"
    3⤵
    PID:5068
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jkw9mf-w.cmdline"
  2⤵
  PID:3920
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFD4D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFD4C.tmp"
    3⤵
    PID:412
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hprrtqsp.cmdline"
  2⤵
  PID:2292
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFDCA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFDC9.tmp"
    3⤵
    PID:4352
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z2bewsns.cmdline"
  2⤵
  PID:1164
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFE27.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFE26.tmp"
    3⤵
    PID:2676
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k0vkuhgi.cmdline"
  2⤵
  PID:868
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF50.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFF4F.tmp"
    3⤵
    PID:3640
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pizsxia1.cmdline"
  2⤵
  PID:908
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFFAE.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFFAD.tmp"
    3⤵
    PID:2336
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uq4jo8n8.cmdline"
  2⤵
  PID:2016
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES125.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC124.tmp"
    3⤵
    PID:2424
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\8--vdxeg.cmdline"
  2⤵
  PID:3696
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1A2.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1A1.tmp"
    3⤵
    PID:2840
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zy5pl5sz.cmdline"
  2⤵
  PID:1116
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES21F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC21E.tmp"
    3⤵
    PID:1840
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\anbh5ajn.cmdline"
  2⤵
  PID:4380
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES28C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC28B.tmp"
    3⤵
    PID:1664
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ouxlh3kb.cmdline"
  2⤵
  PID:4976
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3C5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC3C4.tmp"
    3⤵
    PID:2792
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\emshr-kv.cmdline"
  2⤵
  PID:3408
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES442.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC441.tmp"
    3⤵
    PID:4756
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\omxr0fss.cmdline"
  2⤵
  PID:3228
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES52C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC52B.tmp"
    3⤵
    PID:5080
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bzqu1vfp.cmdline"
  2⤵
  PID:3920
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF0F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF0E.tmp"
    3⤵
    PID:2032
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tuiwpwn0.cmdline"
  2⤵
  PID:1300
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF7D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCF7C.tmp"
    3⤵
    PID:1972
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tbcndjlv.cmdline"
  2⤵
  PID:2664
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFFA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCFF9.tmp"
    3⤵
    PID:3640
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\mnhazmaq.cmdline"
  2⤵
  PID:2256
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1077.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1076.tmp"
    3⤵
    PID:968
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3xt1inrh.cmdline"
  2⤵
  PID:908
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES10D5.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC10D4.tmp"
    3⤵
    PID:3812
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vjv2wtjt.cmdline"
  2⤵
  PID:2508
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1152.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1141.tmp"
    3⤵
    PID:1724
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\80kqwmny.cmdline"
  2⤵
  PID:700
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES11AF.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC11AE.tmp"
    3⤵
    PID:1296
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gfqhzqt8.cmdline"
  2⤵
  PID:3348
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES122C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC122B.tmp"
    3⤵
    PID:2592
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jagwnp-2.cmdline"
  2⤵
  PID:4728
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1355.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC1354.tmp"
    3⤵
    PID:3080
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b6kowe2n.cmdline"
  2⤵
  PID:2120
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vddeiilz.cmdline"
  2⤵
  PID:3676
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES13F1.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC13F0.tmp"
    3⤵
    PID:3936
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xnynofzp.cmdline"
  2⤵
  PID:2284
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES14BD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC14BC.tmp"
    3⤵
    PID:436
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rwfflkns.cmdline"
  2⤵
  PID:2364
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2075.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2074.tmp"
    3⤵
    PID:5012
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g7mc70d5.cmdline"
  2⤵
  PID:1244
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES20C3.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC20C2.tmp"
    3⤵
    PID:3536
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kq7smxvo.cmdline"
  2⤵
  PID:1972
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2111.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2110.tmp"
    3⤵
    PID:3092
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jpwxaxjg.cmdline"
  2⤵
  PID:3132
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES215F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC215E.tmp"
    3⤵
    PID:868
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c7m4fwm1.cmdline"
  2⤵
  PID:3604
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES21BD.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC21BC.tmp"
    3⤵
    PID:1376
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qonfbkct.cmdline"
  2⤵
  PID:3060
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES222A.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2229.tmp"
    3⤵
    PID:1372
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\9xpnulmn.cmdline"
  2⤵
  PID:2140
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2391.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2390.tmp"
    3⤵
    PID:3696
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\d1sebn3z.cmdline"
  2⤵
  PID:2332
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES23E0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC23DF.tmp"
    3⤵
    PID:4592
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dzrdegsh.cmdline"
  2⤵
  PID:4424
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES247C.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC247B.tmp"
    3⤵
    PID:1664
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\n1yqfuqn.cmdline"
  2⤵
  PID:3312
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES24CA.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC24C9.tmp"
    3⤵
    PID:3452
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\t7rh7pcv.cmdline"
  2⤵
  PID:2120
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2528.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2527.tmp"
    3⤵
    PID:3408
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ah3dt74x.cmdline"
  2⤵
  PID:2280
- - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2576.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC2575.tmp"
    3⤵
    PID:4744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES8FAE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8FAE.tmp
Size 1KB
SHA256 7f10e44855e609450e0d05b3ed20171fe011a5246f2570f665d06f2b2171d6d9
MD5 339749f82a7d7b24df99ae25ee686cbf
SHA1 dea48c02d0965b1fb62dec8708a9aaaf2db91785
SHA512 74bd4520ffe76cbcb10ba041d8c99598f0cf3a6101559904959ab49e8c2a7de70afec6493ce29fd1edd15ffad2f0b95d6601a011bb3c3ef8d6d2aa2f4c9f932e
MD5 SHA1 SHA512

Submit Download

RES9953.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9953.tmp
Size 1KB
SHA256 6e4d1a1128a575291a0e9acaa6e2c83c0ce04a93571180afa72a00b0d90d94f8
MD5 4d8bc2deb7f6abadadb041750af990ad
SHA1 8ffcc1869a077e1625ad7918e07644c3e8efd4ee
SHA512 37fa40c1443efbba9fdf0d2e83fe63c75897d23c7cc311d1f55c16d808765d0680baf32a4d826219fbddf0315e9a9662cc956a9f3a02cb446a000081075bd2d8
MD5 SHA1 SHA512

Submit Download

RES9A8B.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9A8B.tmp
Size 1KB
SHA256 c2f76c67c7a03d1c4acc1b56495759895a4e7cf7c4217e8cb0aeb48a7b264519
MD5 9bef36ce526e8cee9e9c6af146d59806
SHA1 18408220ebb35c7832eeede8967f1e46d1f8b6e1
SHA512 75e4b0e874c216fcbae362ed599e16f539482f78e245713c26881f448d9cfe1506a88ae4cc203751880b324eb8a2e0db41d8bec326e58e79dfd4f4203d1e3d26
MD5 SHA1 SHA512

Submit Download

RES9B37.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9B37.tmp
Size 1KB
SHA256 8c7597e742b802ca2fd906938705404c8e6ef04eb0256cb7ce3e066acfb8c70b
MD5 d76f828703657b90c363dc9b6b29caf6
SHA1 a2a6606c4bc2053e70cb01c01d2b73891d40604d
SHA512 8e4e96330a522afb42cac181e7255dd70ac400e5dcf549577ff4641e38c45aabea425bcf7e8eafefe045c131e96f8710bc3b76779cf94b44fce71c5c8482ee4a
MD5 SHA1 SHA512

Submit Download

RES9BD3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9BD3.tmp
Size 1KB
SHA256 e18b69bf784ddc23b6ce3b4bb71a9bf062a3194e41fa545a13c7f3e72eec06ba
MD5 fad8e4e4f0242650b9e5f002bd3c7715
SHA1 716f9280a36b32a0aedde902c32574a2b278ab63
SHA512 2dc21c86077567a18ee33c86613c2b46f6be3d3cf16e0d20bda2e233d31f0adb2a8cb55303b55ea17ae95507ea7f1919ea92dc70f604077411b0b110d178e04e
MD5 SHA1 SHA512

Submit Download

RES9C41.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9C41.tmp
Size 1KB
SHA256 b0e8910bd2fa58cfa5cc226a9800e7417e09e4e655d76484176169861ab425fd
MD5 c14fa3072ea3b82f919be2884ea42ba4
SHA1 63d696773bce46bef5f87b8193002391f32b3ff1
SHA512 bb590a645dfaff246b2c5b10d94a0fa127c1a268e1b9c0ee2c0bfe54562b4cfad1b38814e55c50687e5a7befc644ed56522c68df9189ba281076bcc08362f299
MD5 SHA1 SHA512

Submit Download

RES9CFC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9CFC.tmp
Size 1KB
SHA256 db9820f4647ab438e80651b667c6bba2ffd9a261cf69e87b2fbe3b96bb38968e
MD5 a7d502c0575f9eb947912bff7eeb1292
SHA1 0f1dc6399a2504fff41b13e361e1938c28446713
SHA512 9cc9606750974a37ffba03f596feb8ef552bcec02ae61a61b0dc1e51f38140623d3acd81d8b3ba29889743e8a42e8175c5408397b535c7bd2eea6d9306379b5d
MD5 SHA1 SHA512

Submit Download

RES9D99.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9D99.tmp
Size 1KB
SHA256 f400c0115bcaa966326f050f6003e1008c581b66179ee166642af848cf267738
MD5 87cb9cb45466e2c3b65acbdcbd183bac
SHA1 c686637ccae09cc870215f2fdefe417682eb0cd8
SHA512 502dfd59161e60be0890480eee6eae15fe4d246cf611f9c0a8c12063c36e5d0023bf8967429c6ae23b6b20e81f2ef479983b0546cfbc4c458d78134ef12d995f
MD5 SHA1 SHA512

Submit Download

RES9EA2.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9EA2.tmp
Size 1KB
SHA256 bd1ea72b0c52ed60b6e7e324aaf2b505220084ae4f8ada4e65b8733bdc4ffd24
MD5 44db153aeade7f49a0e009e9d01c05d4
SHA1 d4065a9fd6c8a556de0337b12d273018de1e7f80
SHA512 1120bc40b7e3477fd855df4fed672388bcee76708ccdbdbf99b5038cc9e61f09b79ea5022ba74157e5b12e1221e5c68b68c9e6d1c24390cd73dda9a552a4bbc9
MD5 SHA1 SHA512

Submit Download

RESA1DE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA1DE.tmp
Size 1KB
SHA256 b8272141dd0ebfee36ce960f66f47af7d1517fd3557f04de686993d4056cefb0
MD5 e2127653b1a4161c54f66ab3674ec02e
SHA1 e17877d3cedab3e102dbf1b61875a37e2fd3c7a7
SHA512 3f242d1c8c730c71699cdd43fe710a5376b24bdfed7606a6acf73f1347fd83e460e42168db98e74812097daeb582bb07df4233b630f0979d55891ad6c6708de7
MD5 SHA1 SHA512

Submit Download

RESA23C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA23C.tmp
Size 1KB
SHA256 4b34a191698deea7e78c539a42b6136d77886401acbe12b733000633661a90b6
MD5 372fc5f11a8225d527bd54ec552baac8
SHA1 2672e7274d1d0b803080123c52126348189c9a35
SHA512 dcc2fdfa137f3e7991e51f9ee4c70c1f515b90c0083b01415833cee98b673d830fc0297c51cb8677efff7fa9b4114b39f3fbcab889fa0d261cfbc8db1bb6fd6c
MD5 SHA1 SHA512

Submit Download

RESA2A9.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA2A9.tmp
Size 1KB
SHA256 f290d251a835e0737825a825faf6ef8e0b53e8db3fcbc1a431c4460de98e27ef
MD5 517c562c73d533d23f4b84eb22c86cea
SHA1 41348e9abce5fa02f435afb7bf0c6094966e0120
SHA512 3a647922d3b77c3bcbde58aa72a43d56f08792d0469705985a097cad455d053bcb582a4fecfff6f44ba75d6fa50cc836f26e2cba3ba144c71ba2f4d83575c6d6
MD5 SHA1 SHA512

Submit Download

RESA384.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA384.tmp
Size 1KB
SHA256 b5995dcb00a52c7122a8ce5abc6fa627c068849f1c02cec8d5d120229ba59c0c
MD5 367aa01c4f7d2c31a32362cd1403a668
SHA1 22195606b134f165ba333ac21506093c0ba5d362
SHA512 de1af7fbb4539894d4a9b6eed74cd3fd4dd309ed1fcb59b01e3c065cac2b4a2571ce85f1bcb701a035cb92612e74a2c5a942d6c3ff13eaa6c7bfd4e29baee35f
MD5 SHA1 SHA512

Submit Download

avnotuw1300.exe

Path C:\Users\Admin\AppData\Local\Temp\avnotuw1300.exe
Size 120KB
SHA256 2532a12a6611e8874b0e87f7ed0a71fee5cf89486fa472752cc516328fc4c637
MD5 51e4cfb9129dc9995a34627ab65bad33
SHA1 525f8c61b7dab5c9d21fbd04b2e6a1d182d90b70
SHA512 fc4ff22c17d43145b7ac6dcb5b4dc0c31ee8de45f76eb94de1d671e0b2a95138d4c6e212770d6904b5c518d979e3c59f8756d458c5b3df4162c5128bc8547c24
SSDEEP 384:5qT80Lxwp0baLDtlcUIQULZCTN3Iu3oG+0VEVfBoVGuBcVUoKlmrgdSormKVL7z+:8TLxmPt2UIQml
MD5 SHA1 SHA512 SSDEEP

Submit Download

ezupsxf1781.exe

Path C:\Users\Admin\AppData\Local\Temp\ezupsxf1781.exe
Size 120KB
SHA256 e03f614b17e0eda9d1625dc69d1ab66cb7c53149fbccb295a52d17aed88dc189
MD5 e9da14f307bf0be03427f6393424ed55
SHA1 dfbfc34cee18cf7d381820ed54f49a8ad94c2a43
SHA512 f00fb4e4aa3747965a6e978ed0c41baade2e6d5f34a45eae9eb59538a1011503332bc39e245ebe037555ae43d8e3c0e84bf2862797d6153a9e729876b0d8bc7d
SSDEEP 384:+ElPNlU6zPQbaLhv8G9O9MKZc0H5VRbDPxC0+ZVD/rg4HZD5xGC6e+952DaR16xV:ZDn1E39MKi
MD5 SHA1 SHA512 SSDEEP

Submit Download

hidpymv422.exe

Path C:\Users\Admin\AppData\Local\Temp\hidpymv422.exe
Size 120KB
SHA256 6839a0393ec0edcf1f9bab63fe4349212c9316d326aba9f789836ac6b7a2a7bc
MD5 67d827535924b3d5eaa8837a15d4c7e0
SHA1 9c9eb8a8b69e48f9f9a7babb673d75dfd42c9da7
SHA512 83076e3a574fa4d9dd83c5d52e3108b8bd64333df5b6d04059f185d9fa6f3be713a61adac28d999a423efd83d4ca6c8b3db1b5b61eb6565e83322481dd8a7118
SSDEEP 384:QclkSNb+BbaL6HfWGYcntE3mlpt00Cr00scPdJFmz0UrbZxmZ0tn00v0BxiWvam:LfNbPeHlAy
MD5 SHA1 SHA512 SSDEEP

Submit Download

mtcsfef1656.exe

Path C:\Users\Admin\AppData\Local\Temp\mtcsfef1656.exe
Size 120KB
SHA256 1734845b707d59edf6a53820380d8184f4734f7bbd1ce51ed2c607782cf754a1
MD5 ab850f39259cfd290b4d072874c1a198
SHA1 9c248485a2a7bc199764f8766b7aa47482763c29
SHA512 b3b178f6807c1cab8fbc9b95baf590fa6265d75c54f5826e9ac8e093422915d7315ecbb6e226413310d8b2adb27a98709db231774745147c283afbafef75de4b
SSDEEP 384:5Igv77baLalAx6q3lrvxa7UGIiDBvr2L9Q7YH45S//YiLMo8C55IHb0FluAMuEjV:uv2l+6qJA
MD5 SHA1 SHA512 SSDEEP

Submit Download

myjdema1015.exe

Path C:\Users\Admin\AppData\Local\Temp\myjdema1015.exe
Size 120KB
SHA256 8fd6d0cadedb0aef6e69444d5ab5bee2a56bd49a461dd0c96617081147ba6b1c
MD5 b442ed11ff2aba77410ff175f8b8021b
SHA1 d0c18177dde0053677a45d80522449b5f1b9ebb6
SHA512 13cb85e4331f99db9e6c96da558f55271dda16e0e2d5c87cef41bceebc260fa668b92a0e6041df0d04c4c2faf9c69a6f3010fc741cb769fc7f81dd02deb17398
SSDEEP 192:QcjACmMWELhLxVqW+jTTWGDayaLDi7ytIt9P+VIp6tbO3I+gQcXA:QcjlDsTnbaLDQyAl+VIZe
MD5 SHA1 SHA512 SSDEEP

Submit Download

p1544h.exe

Path C:\Users\Admin\AppData\Local\Temp\p1544h.exe
Size 36KB
SHA256 193ff3154d9e5c356910525b30b1ca8ee6b06f72f37da105b2c664d73885f9d8
MD5 432e153016710a2cc8cc5615f7a58daf
SHA1 8e884bcf3a0da8d0c2c706b2d9d626faa8f2c839
SHA512 c15c433919c848812faef86d10000577c340a1cd7beeb481d4dfc46196e6360c1c35b93c5a349bea3e97f74ab187f9686ee71999dee81db6473609b07c3f4f9a
SSDEEP 768:RYz52dW9mzo2Fybkz6Wzp82wLZP7mmMo0enpvfLHsQj3R:8hzR
MD5 SHA1 SHA512 SSDEEP

Submit Download

qziklxi1259.exe

Path C:\Users\Admin\AppData\Local\Temp\qziklxi1259.exe
Size 120KB
SHA256 5a3267e2d495730574adb92b083258212314472112f31b9c84dcff5766d5e643
MD5 c8147939f330a790b5aa627d4f902214
SHA1 137efb493df242d542228a143066b3e2cfc1b443
SHA512 5660817b07e65bf01d29e5cd9c2d2c1596071e65eb62af0c8528d8283406c9b664b69140faa5a36b6ab440f884fb57eb1fb391b0ae84ef71e2004776b48c731b
SSDEEP 192:tuACmMWELbUXRzcTfEb5rxrWyDayaLy12TRtH8NqQ04M3wfK6l3Q8UD+UfYU8jVi:tul50AzSrPbaLyQTR66Vwi6l8
MD5 SHA1 SHA512 SSDEEP

Submit Download

rjhhmej250.exe

Path C:\Users\Admin\AppData\Local\Temp\rjhhmej250.exe
Size 120KB
SHA256 75c7e9dbacf6e6e660646395af73a54a5dfa78110b333b7fe67e88c7a6da3c4c
MD5 0f9451dd6e267ad69c4265515f3f32ab
SHA1 b8c6c93ddaaf7868b6faff340c5ca2f58766d8bd
SHA512 9a81651dbe1e81e3402678b7e43ce27e972f091ee687bf0b12ece99284d5318fe05a22847bed77b14bd089b688f254db122a126561adb08e2c0d30156627666b
SSDEEP 384:5il3SNNebbaLlnfC1c8ge1tZ5LLaMDDDCEDDDDDDDDDDDV1LeWmDDDDDDDV1yyWn:aiN/RnmcS
MD5 SHA1 SHA512 SSDEEP

Submit Download

trkxtqu1052.exe

Path C:\Users\Admin\AppData\Local\Temp\trkxtqu1052.exe
Size 120KB
SHA256 00c54d334209956ebeb3560cf6a74071a3403168b801d7c424e53e3d062cf2cd
MD5 f8a139365bd651f23312c635b564e37e
SHA1 5127524e695978e567009c1038ff1bdc956e76f7
SHA512 402dac39b954a12ba3cf00f8db45728b3ff72116c354fe9e7b98094a9d19be0263f6f4526a3f73e3ddaca306dc5c6338b60e9d1ce4d164b966d2f88adcd076ac
SSDEEP 1536:5WoFIPCDS5NkYoJA7bTXFPqqJAC9Y5ei2ztGirFymYUKsgmMF1C5ShgkbdEqNExf:sT
MD5 SHA1 SHA512 SSDEEP

Submit Download

usaeyyv1563.exe

Path C:\Users\Admin\AppData\Local\Temp\usaeyyv1563.exe
Size 120KB
SHA256 33871cf02d19a98f9e23ee70e334c2bde696179b869d02df0897d3db52f9b9a3
MD5 a643804c92c0a7280a60a45b4797fd69
SHA1 573243816f111f65dba6bc984a19b6ccde40b277
SHA512 45d5c08957aa2c95b3d52f26d4a74c80981b18e2df566bd448d7bb182f4cbe7fcb92b39dc1f08fed6b17bd18a9380a53ee861a95e3e4e9b3816fc0176406f703
SSDEEP 384:+9lJZt3WbaLYRltMDDR7hW+Ftn/9QLzftO9zoLau72HK23Ff2y2GzXswRR1+qfuT:ofv0R7M/Ri
MD5 SHA1 SHA512 SSDEEP

Submit Download

ylkrxmb570.exe

Path C:\Users\Admin\AppData\Local\Temp\ylkrxmb570.exe
Size 88KB
SHA256 5ac0df3b1af49e0c3c5fb270bda21171189b2d7ab8ddb96aeee03feb35dcad7d
MD5 8ef9712401d3084119a70990ad5d6671
SHA1 6b0bb2d074004bbdfd091a0377373a829744a49a
SHA512 0a7b7d67febb11d8d506b57f4eaa180a26f3fe53c4120cf2f0248d5db3906d4c46461467bc103de34fba7fefc957f07502eb8ca5ec71295fb6de8fd9af34f999
SSDEEP 768:5WAxT5gXGYXMY9naz4FXd/zLLjXH/8ltvbHGQnblU3ZfljHVrijB:5dgRXpasj3C
MD5 SHA1 SHA512 SSDEEP

Submit Download

yqvxjow1016.exe

Path C:\Users\Admin\AppData\Local\Temp\yqvxjow1016.exe
Size 120KB
SHA256 205bfa606f5c78c95580ac0b2697abe0be99bca7c4e1f6128ac759ffea7c961a
MD5 c56229fdf9fa7118f406337cdf17b64a
SHA1 6fe94a0922aeddea9a819aead001cfb5cb0366a4
SHA512 ee37c7127d992ec9f625a11986398848e6a91114c5bf43c09e0d466e3186cd37bfd059500302604f93bc0e5b4dfd06831e7b047dcf6a6e2f7747ae9324fed237
SSDEEP 3072:h0XIeoqPcM8x8b8bc7qo8Wq3cFg2XGjdeoLBIi3Lvx/WqUhaIhtV3cq6SeYQO3YV:2XIeoqPcM8x8b8bc7qo8Wq3cFg2XGjdS
MD5 SHA1 SHA512 SSDEEP

Submit Download

zthrwhq993.exe

Path C:\Users\Admin\AppData\Local\Temp\zthrwhq993.exe
Size 120KB
SHA256 d6c0456a6dec0293dec646cc18c3783bb22145c92401dd277f19a64c079a6115
MD5 c5fdef89e3afacf87511046e4d89f10f
SHA1 eac92dce9e495832844bafe78a78d16b067fd901
SHA512 eee307a5d34834975a7eb82a2dda533a66baad74da96c73a0a0a375495342afb9ada7cc3dc3f25e664173c6daa9b13d3eb4131477c761f4ee1c1eb4b5da8a7b6
SSDEEP 384:+6gSpJCq1baLKoGZ9bz+o0IHYVXDyWVK:lXMmoOl
MD5 SHA1 SHA512 SSDEEP

Submit Download

CSC8FAD.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC8FAD.tmp
Size 660B
SHA256 b3217f0ba430d31e9f6d0deb2c68c399515c07b2baeb06eb4edabc3f39058255
MD5 d05eda5c92d87467b0ea6a43326c97bb
SHA1 559dff4a36560720b2e46e36cfa607be165d441f
SHA512 9cc2b3a09972c05228f856378a1834716f277585a1016a44f70f55e2bf7bd57e78f2a92ddd02a622a6a7382fed8ca5c2a990a20c83303eb98bf0eb04b5ff8804
MD5 SHA1 SHA512

Submit Download

CSC9942.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC9942.tmp
Size 660B
SHA256 474641001c101550d6475d494c69333b590d76f47e25ac2f3ee43389127cbb4f
MD5 ec582663d4c315dbd12901c2c3f19749
SHA1 cdcfe8449f7aefaab5be1e2babe2043d940e0d8c
SHA512 cec11a575386a4b25a62db2d2e075b6a58ffb5314ea2fa2bf82086a08d888220d4410ff11e4456cfc8741df89de8e80e6ecb675d49bb38a6b4923c1f26956413
MD5 SHA1 SHA512

Submit Download

CSC9A8A.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC9A8A.tmp
Size 660B
SHA256 39a59239f0635a530285ebd49cfb04e700d7e57184d56ea83ff6ffe4ce2c8ea3
MD5 3c2739a822d2af464aff78f523f05c35
SHA1 1d01b7d21e68ca05fff6300f29d0a57b4a1e05e8
SHA512 e54df56be547b89e101cb309e85d550fd882bd80c12cab547bda3b4a0bb9af7d363a800cd212e086dbb9aeaf5570e40c143f11fefccaadebe1314135d98fc5c2
MD5 SHA1 SHA512

Submit Download

CSC9B27.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC9B27.tmp
Size 660B
SHA256 32d4247d24a947827c2e04e886a70b563c52f3ec095385d9340d3e30533a6598
MD5 ce40e2ffebcff183c82f3ab15018d7a5
SHA1 22a6179e2d8d436bf44f21ef42eb4249315f4e9e
SHA512 790e04a249307b0063661bb1b8175102cb48871b90a569e45b96e03bd0a856fcf31d60f0d189c994f17912b9951f3992e28307f21048fbcbb249129f1d6761df
MD5 SHA1 SHA512

Submit Download

CSC9BD2.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC9BD2.tmp
Size 660B
SHA256 afa7996d7bd59ef0ccefee3ea47e78a5083bde2572b00d90187fba4d5fd1befd
MD5 fba93e339a6c8c3481bd8523859b8c19
SHA1 d38feb63e1b7e00d2a5a84ff05879af803ab451d
SHA512 ed25f4d705dc55566610204e612774dd6ee85fd32bb7012636d763731bcf74db352422d4d54906b4fde007b12e4710d90fe0bbfb1ab7863ae18a2f8d7defa8f1
MD5 SHA1 SHA512

Submit Download

CSC9C40.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC9C40.tmp
Size 660B
SHA256 e66a97ec270f58a2e7f7060ed86020828141daf45bd7b7d983aa9c37d1cabbf6
MD5 6c64c46ce33ab7100cf9fcd161e24195
SHA1 d79cf4b9fb7d4b2264ca531ae30aade6edafcd1e
SHA512 272f16761563b876546aa46a56ce3982a27ad541360cbd821e9624bd8692101af1328a599657f036ce4769faa3f33617c08dffa0b5704c27ff3cdf16aa80e306
MD5 SHA1 SHA512

Submit Download

CSC9CFB.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC9CFB.tmp
Size 660B
SHA256 a75b07fd7d79ec7287116b9a5ccb1010f9eec9e1f4ea2ca66a5332789d048229
MD5 35e3bd2f0e50b91b3fe2ffb22029d4e1
SHA1 85cc140b21761c70e6b94125f475ffb6f2a595a6
SHA512 17bd9286cc8036de8ccd3eb7b33190220dc2048df99d7a406ca4c1fd611591777d5d5316508e9ed6eb90865edb7e12381b27c7daf2200743715491e451518194
MD5 SHA1 SHA512

Submit Download

CSC9D98.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC9D98.tmp
Size 660B
SHA256 978a474aa69a33086bdbd7689e8f0e9bcc417084c12d4bedeb87a0478bda0a29
MD5 43e50411e8af2991572cd67578a22188
SHA1 a9da50d52f8308e1aeb79e4506668fb4bfc1f9b8
SHA512 1398a4a3d7a7469c3cc80cb9639db3576de75cb5b05fa8b144509fe4795ca74552d55be390ea5709e9d7b9dcc6482014e0ff3e049de75d7113e6fc641dae3bef
MD5 SHA1 SHA512

Submit Download

CSC9EA1.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC9EA1.tmp
Size 660B
SHA256 3de7cecf59fe2ee24990926209a1addf88c7049031d968caa44607c906f6e55b
MD5 610b4e4930accecc1eb84abeb04f5cf0
SHA1 9ee6550065ec5ebb17cf682b979e2cbb6c89c560
SHA512 21664313b9744eb68e005b148d226aff525767c3f07c8fac38e4444a8d43b3bb0d472b881c9e731a5a2856b0709b313f6b39ea52a27787c87857d4d9a3b07d65
MD5 SHA1 SHA512

Submit Download

CSCA1DD.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCA1DD.tmp
Size 660B
SHA256 3196ed31f1822f1a76e075db2bd57ecaaca693c3a6dcd108afab39a91d315ed8
MD5 75184fee04ea170c69a42a969c3cf7d7
SHA1 138e7e5cb0345bda0ac6310c63663f50a9fab9be
SHA512 ed3f4555e9c1702b6842c96c74eed75bb1fbc00cb804306284234ea7ffa15252e1224cb253d09a9f5e8651737c57f78722659f0105b41c3e3894d26d0114dc76
MD5 SHA1 SHA512

Submit Download

CSCA23B.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCA23B.tmp
Size 660B
SHA256 5efdb0349d833eb5924ae7757e6181f84bcf0534ee3612ad4c98baa03cf9cf31
MD5 32918da496de46bca30f258639ba2e0b
SHA1 b1485ee56f21453ad8dd7562c2a6058494c88f1b
SHA512 724ca8369b0f7fc0c6ce9b39e5f8109a2ed812ef790bd566906f510068bf8036a68198a064f0806e9d3a77e005e18fcffd6fcb91264cc7b7b7381f302e4d239e
MD5 SHA1 SHA512

Submit Download

CSCA2A8.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCA2A8.tmp
Size 660B
SHA256 87ce35257b53419b6c50ee243069e5c0d729edd3d9ecf978cf48d3750a069ce0
MD5 46f6e9664e5aee603b5a44e72d36f053
SHA1 8212fcda42e5e61ee4c31131dc784ae267be061b
SHA512 a315cf41de38133cbc8e9b397c4f88fa592fa7077f6bf08cf3337d8c27ea95348176f27ad4bbbbee6173b875a83005d26280adc81ccdec16cc62f9463d971206
MD5 SHA1 SHA512

Submit Download

CSCA383.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSCA383.tmp
Size 660B
SHA256 f951a20c7c64bcbf5fd0884495a9a0654eefe8387ca914baebef00c972786268
MD5 2ee20f2552f6cc2103005ff3191d811a
SHA1 2019c04addb867dfd7ea46615ea35cfd33d827d2
SHA512 43552906b686c316c50c44851196017b6511e0df47d0edad535491427a5df04ff8a698c24a2167f366aac63404b1a30520caf918f4fcb994ecedc18759cd7c05
MD5 SHA1 SHA512

Submit Download

b6cqgytt.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\b6cqgytt.0.cs
Size 61KB
SHA256 dd8e93d17b67e0f4b119592ed4c0e093be83ca8c44152aaa90d2ba2436685ff0
MD5 d575c50ce0db9d16228e7a68d245331a
SHA1 693fb35c50f9307d3344e1de74a5009ccf52ab6e
SHA512 b8d72d6ce1c865c9691a37a48e55e6801767a95a91c62a4d7c006451ff16e0dba50fa00ee2f028363038822b8047d38c592a1f4563fff75ea863769cae550812
SSDEEP 1536:YhxjcAmZMH6zPHG0kZYA1Zqoi2FDfkFaZ0Yo2Xu5Sshxl8:2H0MH6zPHrkZYAPDnZPofc
MD5 SHA1 SHA512 SSDEEP

Submit Download

b6cqgytt.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\b6cqgytt.cmdline
Size 145B
SHA256 970cdfafa0edb050b597fec6abdd2d626fa49a365ba4cb2f45a477a141c632a9
MD5 6b44365a0edba6f823900465be1e76a8
SHA1 4c7613abbbfffa053ba6941f4e409bacc91ded28
SHA512 856f1fd553bcc93d2b0a7350bd6e0956cced097987ebb9f87eb25225c57ba0a55575763150c3b30a20afbd792312be1ed1ceb438a5aeb956c0a1c7974482ec8d
MD5 SHA1 SHA512

Submit Download

b9gvqqbl.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\b9gvqqbl.0.cs
Size 61KB
SHA256 e2e766ab6a1882990158122f1e095f14bd0599e3ffaf202afd87a79a98cde4f8
MD5 89cc1efb31dedf258463c400b4f6a332
SHA1 ca1ec68c0b08014029a3c1255554c5ce01bc9c13
SHA512 74fc0f39282bcb27fe03cf937a51cac671e4114c31fbebd7826ba9697ddcc28c998967ca64d8d47d378ab60dbbf85461a4a73caa9b5206cfacaa210d0dcd8404
SSDEEP 1536:WSx1c9yJycAWN8helsIB5ayEkKurE3g959k9qsuVc:WWc9yJa6T3rE3gz2AG
MD5 SHA1 SHA512 SSDEEP

Submit Download

b9gvqqbl.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\b9gvqqbl.cmdline
Size 145B
SHA256 e6e9ef2299eb209257c2b4ec7df83a6fc99c77cb4bbc9edba2e502184431c3f9
MD5 4ca5a582abc88a00566f8465426a5008
SHA1 c1482877021a2b195cd029d5307ea8525e3742ff
SHA512 531bfb932c900320124be51016b3a75e049640fc6290748ba1e17e0d4760edf47c82f2432ab774ca5de1ecf5e11fb978f39e48b45cc8ccfe7e590b400a50e1d2
MD5 SHA1 SHA512

Submit Download

chbidxgu.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\chbidxgu.0.cs
Size 61KB
SHA256 1a88f9ab10f480de54bde0b5c56eb07c01615cde6266da4170a50347601db102
MD5 af79c46c4332bd4b38091e19342f4a43
SHA1 387d93a03ec3266faf8ca2cb828635f5016a1b69
SHA512 23cd74f18a72639b9867adb9732f3d757261717c265e869ab98087bfb0d8ac29841b300ea37155dfbddefd5113ee003c4405bd1e320302ab1d9332d0a299e3f1
SSDEEP 768:y3NPVDwa8qHcZ1ESgTpdj2370CHkxGEap66+UICaNe1O:cNPVH8scZQT7a70CHkx5ap6vUIBNe0
MD5 SHA1 SHA512 SSDEEP

Submit Download

chbidxgu.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\chbidxgu.cmdline
Size 145B
SHA256 091b3e6d0bd0de71919e8b5d54c07ddd646da4901ea846269a6668dec1904ebb
MD5 0b7f61cd0b86a494a2f7fff8644b58f1
SHA1 bda9f8f866ab3012b53e364bc2af8ae020e5530c
SHA512 628aaa37db2ddcae99b077c08eea02c499f732138c5c3663d341f96f709e67b3a91e98ef2c66b62d2f3eb2ff3a904f8d6f2f6aaab1fb788f0e671c5fee7bbe04
MD5 SHA1 SHA512

Submit Download

g4hubtci.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\g4hubtci.0.cs
Size 61KB
SHA256 9552fa6bf3295e66b907e8e92214c1ff69ef432eb5fac1e7772811ca71b8afb2
MD5 695b52c08b43ccf69d463b5bfea30f9e
SHA1 47f8d5201141e072578d0ad4471acf2cfefd272b
SHA512 b81262b5d46f02655c6c3b55c8c1351ff000cddc53f241132c528df152a31e417fe903772b01c55f0ade42f794f975618302d4c0b46510b0b0470ce2cedd2512
SSDEEP 768:vKtdLMSw4mRsBKsIZszCs6hKa2l824oVJ7WArv3Pja3O807gEkF4ozE/:WfjMvzE/
MD5 SHA1 SHA512 SSDEEP

Submit Download

g4hubtci.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\g4hubtci.cmdline
Size 145B
SHA256 b6e3b1b5faf0109410297af682d12764583d00bbba31c8758bc016f2830da13f
MD5 9755087c374825b36101d388a3eeece9
SHA1 03cd3cb978f9596ca79a20b866f62f1c21ded67a
SHA512 fd405947db1d778c74ef0589330d268dc3b60855f110939a5d45a2afc25b7135578a28c58c95fa68447584854688ed816e12dd18733d24f5ee52b33247aa5fab
MD5 SHA1 SHA512

Submit Download

gaa6ufsc.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gaa6ufsc.0.cs
Size 61KB
SHA256 008c21b45645c6ec10696434b6fb46e5cc62df11f5fa3c184a18f330c8c1f2c3
MD5 49d26c2c3d8448f1c492ded41b6ce547
SHA1 2169defdc57d5d792e167bff75c0eaa4fc2cc27d
SHA512 6a84a4034d9a6d37be0b99d9c89ee351580ce6bc689cbdf93c27536bccd8a4c97c4c1605a690e9563bb4f8df94ffa5975db2455446ba221423ad95a9be9b559b
SSDEEP 192:9YCdhF7IaW0ESHbBQIV7vYcYFaFm5mjmuTmoR0wIkCaLh1xJKHcfcZ/cYdmuvhZD:9YoQPOol4/myl+hz9B
MD5 SHA1 SHA512 SSDEEP

Submit Download

gaa6ufsc.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gaa6ufsc.cmdline
Size 145B
SHA256 67d68aa05ba7c5cff5f47db9c0d706aacce7828aaf6153a924c83245ed0baf03
MD5 ed35d452ab283c7aff5c6ad329a1def6
SHA1 af4988508a9bb25fe6664547d35f5370295ea3c7
SHA512 11b03092205318b9f44a0525d7d7b3646a5c39021897036eaeea0a0a52bed3f470171bb39a28e13036a9f973b9b0d305a9eab98c8e5042074547cbaa6a0aee7a
MD5 SHA1 SHA512

Submit Download

jw86rjsh.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\jw86rjsh.0.cs
Size 61KB
SHA256 5c4d45d5b46f2b6860509967ae13ca60985ac561eae7a2d9500684ab0a0cca5d
MD5 8b41b8d1d3bf2fbe723635e78f23afc0
SHA1 98188f7357ed4b67139b548b1c6ca7b611072795
SHA512 5b9ffb2b4bbbf9e85c7ffc8835c5808b8f8a4547236a8e5a02bdc2916eed0fb69c8c9ac025edba3d85fdd5ace51523e14ab1e6ad16cdd6f63841d1545acc7c05
SSDEEP 384:9YPqtJGEGxooUWOLRbRtxtnLtktUJVI7MdoBv5W4es8I19tWaMVFDt8dt2GZ4xlk:pJJpOKjwmEB9f/Q1SA7DQx
MD5 SHA1 SHA512 SSDEEP

Submit Download

jw86rjsh.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\jw86rjsh.cmdline
Size 145B
SHA256 e23f5abed4f3090e61da9bf7ace162cac0525cb9bd7306143e2ae6773ac15831
MD5 5559620f9b6a9d8020fabac7784e7f76
SHA1 9f7f794dc91fd9cd3a611025300186e0166506ee
SHA512 a484330ecc30cad6716e1fde34fd6246da9021ce33445fce06ae7537f6a9aa97d6ba15e24a32f5daa18762b148af6c4c4d82ae9077a7480361199d0c7aff4ec0
MD5 SHA1 SHA512

Submit Download

jxglmixt.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\jxglmixt.0.cs
Size 61KB
SHA256 6b2308546527b73019a7497c553150c62ddc1ccf3f5783a7a1ddf990bc61432a
MD5 13bb192e5bb14247863dc474bbbadf62
SHA1 3f7fb9b59bbd09f45f937d293e362297d2f3d0c0
SHA512 668e9b23e96a7e54b4acfacc973b36a7bc8efde89459f57b31a097b89802e8c5aff113db9ab36ac5fe77cc402697f48fd32bb187ab2eada0a7adb0ae2c4b77aa
SSDEEP 768:1g5gDVq9gqsVsq6l4LU+0M6khkhWKJ1Mqqw8gsogrVyQtgl0llbpna7:rVqmqsVsq04LU+/NqqjUlWbpa7
MD5 SHA1 SHA512 SSDEEP

Submit Download

jxglmixt.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\jxglmixt.cmdline
Size 145B
SHA256 c11a0cb00229af5e2597e4b1ccdd93217f1e19a86a86891ccd1ec8207a3a029b
MD5 d614bad7e0820ae7a89c7e012fea790b
SHA1 1ffc5fe91ed9382808a16e675dad0bfbd5b3301d
SHA512 2f134c60ac293171b542dbbbefdcd1a28f5273b6403a5f9dc1e94ef0a47de755d756165adc1046ed9b3763a09dfcfd8ace8f95961142a1b759adb5de22186479
MD5 SHA1 SHA512

Submit Download

ouwtgchh.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ouwtgchh.0.cs
Size 61KB
SHA256 3d14a2deceda9fe0011d3d56d0bb8443ee534f7ff8d59d083e363acd4be083fc
MD5 5a594aec96f8ee4bf284e9c9b682fce7
SHA1 1b2c2c9886b787865fc5dbce2fac4cdf0e903676
SHA512 4f1d84d57146e328fb14a6669cf719d68eddba77acb12c87935dc60dbcb16f3db110c01c8a0836e766b789d5225c3e78557312c392aede36e8739066c4d1ed5f
SSDEEP 768:2vOnhpQSaMcD8Gje4pVJr6VJp3kYcdp8Qpo6bzZufrOYTioLA0/nOUJ0iVBFNzdI:b/+RiVBwXh
MD5 SHA1 SHA512 SSDEEP

Submit Download

ouwtgchh.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ouwtgchh.cmdline
Size 145B
SHA256 8eab28f7aab5fa8bf0fc2abfaaeaa660f0d674dea77a46cddbcc66a071e9e3ea
MD5 8905acf151fe8332652e83c19d1c5e3e
SHA1 a0275376a278fff00192311097c43b43ea930528
SHA512 ad1410c760797b2c3252313307243aa3c9ae52545e8ecfefaf5e02af926dfdc8874ac808a222c2bb31b47b4a43e9342a7bbc9a9681f32ef6d88c6a5fd40394bb
MD5 SHA1 SHA512

Submit Download

sdoqw4kn.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\sdoqw4kn.0.cs
Size 44KB
SHA256 23a5447a2df2b1cdc9c19423dd271a02305f50d121696866561b08d840e44552
MD5 a619e4c72477ef68e0b5ff125c1b53af
SHA1 660c4838e97a9ecea2a7f112489fb65988103de3
SHA512 1a13aab7abe34e04f6acdb0d1af81d2a858da4a393efb9218e367086a627f37dc5c293e39f197f00118ca14206bea48a54a173c49fcba796bdda8e261d4f0eda
SSDEEP 384:9YPmpfDyGSgKyLnpvSp5SkgEnvEiTKi7Z8aTOyeZhp65gQ4OumgBGJlaB2ZQORki:VVTCgf0Kyp4pYTjg0iVS8mCrs
MD5 SHA1 SHA512 SSDEEP

Submit Download

sdoqw4kn.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\sdoqw4kn.cmdline
Size 144B
SHA256 23935fa6d8dc324f487df781895ae0d3199c7ce7ae8f2bc24a2c4dae91ebd04f
MD5 a84b51a14b2e227929ec391d87100eb3
SHA1 d69c1485b2c1f10192d5cedafa02d0814e78aaa0
SHA512 3648c212ded5e6a8fc912c28ed12190852c9f74f93faf288c8c0a10de04e9486dda04a924c2c406d5f17ac55cb57fb5b2127704ed7c324d09a22d78f6b4119cb
MD5 SHA1 SHA512

Submit Download

shj0ldtc.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\shj0ldtc.0.cs
Size 61KB
SHA256 66c967c0229f07206ad162adc7072d05a75f485918145cac51674765ae7703f2
MD5 dc86c0ebc586d5478c5d60062098d57e
SHA1 9e6837eac40ceaaac3848c618d85595bef6f6773
SHA512 2d9c85fd6f95c39df6a8b807d7ed7a51598fd425ff50bf77cdfd9420cfd18d82cb21bf2906e2ad160b8dee66e2c741eca933e27301cc6437dba87406ebc01221
SSDEEP 768:BbExEJhY7bYKuNJ/EhndGHSyylwikoSwtQGy:BbExEJhY7bYNNJ/EhndGHSustQGy
MD5 SHA1 SHA512 SSDEEP

Submit Download

shj0ldtc.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\shj0ldtc.cmdline
Size 145B
SHA256 cd3d48dc2ab656c9800f086fa8d8e7e34e4e2da843658e277c6d5ea68a21a964
MD5 77e0a48b2e42a43e23ffc89f147ea1bc
SHA1 da611112de08e5bfcea016abdf7da86fd344bd0e
SHA512 6774ce1d5b03f9a9dd14ee54e01eef4a529a2b419f8f9a4d2f0bc3498cf30051a969c5d334b2d80e73a7de9b9380dc73cae13946eec8dea2db19396dccd07657
MD5 SHA1 SHA512

Submit Download

vjmoojrl.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\vjmoojrl.0.cs
Size 61KB
SHA256 13ecef8ac4d83250e7953dd1e04e7600b571c29f36a5e0c2712e92b372888458
MD5 b525b417b62e01bf2b51361dd630122d
SHA1 e09dc279b07d32199bf7af6b4edc5d295e02a735
SHA512 6339d30af60a3de6765f458518e25e5e5463da8aa2b62e2cfcdbedc3a873e1f7bf96ad93848b40ee233099a7a2e721c54cf49c3eaef76c3e123d9644cc18c57b
SSDEEP 768:M6YVUGNlKdNEtCUO9m29Ip1cW5x9jY4F1QJ+:MuIEIpKW5x9jY4fQJ+
MD5 SHA1 SHA512 SSDEEP

Submit Download

vjmoojrl.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\vjmoojrl.cmdline
Size 144B
SHA256 8649de9a2b0a1eb7f9285ccd8327f0bf64eb2baead4138e91e1543cbf10e7f45
MD5 3d6f3b6b3674fdcd8302b5605d42fb21
SHA1 a63d05cd6257c24407de0baccfffa893896710df
SHA512 9c053456918d74c17d531c4cbaebf62392902bd0141bbab0986b1092da2b9b3c614855206e00f3ea49fea3c2acce0f6c855cf21b6a59d576e43fe89fc7cbbe3f
MD5 SHA1 SHA512

Submit Download

wavbl9t-.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\wavbl9t-.0.cs
Size 61KB
SHA256 8a76272b7d162170fb8a5a62a12e33a64fb6d09b4e88e73b247ee54f5f348252
MD5 297ffe2d11abfe7049027507e55ad1fb
SHA1 4d3b27278fc77fcdc841de79f45a61bba20a4058
SHA512 9a95a059f0f7623e80bfd6ded5f85aa38e7c1ffc1807d62a387bd7cc2f3dd907d90090e2d5bb10b65e70908866c8ee7a3144ea9cc6c7c178b2d04ba4b5e20276
SSDEEP 384:9YQzp9uqfRgMHLKfzznnK2194fzdYYFROWq2zxYT46qM6fRP0A2s4wWfGHAo32k6:Zf8f/nwf2YXd39f2f3o5CX++L
MD5 SHA1 SHA512 SSDEEP

Submit Download

wavbl9t-.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wavbl9t-.cmdline
Size 144B
SHA256 5775c69cf42bb396a0fdc80bff616003463c09fdc7733e5e279dd690f751a9f4
MD5 951472f4434c982cef17edd9d78bd158
SHA1 581e4b1b12fd5fd9628d29b5b757c0771a3c3f2f
SHA512 106f5fb3bd4e14f5c3e7577f0541c08445488b031adb107200a8f70c4e09fdb14591a831b3d647fc9f519943e57715b71408830d96d2e5873912989016277bbe
MD5 SHA1 SHA512

Submit Download

zfbnnf44.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zfbnnf44.0.cs
Size 61KB
SHA256 54e78270d19b3891092a6919569bed8cd8c00f559d718f59611c76c444a00c0d
MD5 537b7cd303695519eef012b751770e98
SHA1 a086ed4d1c42f359da48c137ed9d4effc238b797
SHA512 408e6d2be7c0f36db08a9a3db4a44f90509e90009ff792b7996af072fd7cb780dc0f70d6fe0fed72acb79b2379190eb271f1ae53d3ca4a0846ba5c7e7a599a2b
SSDEEP 768:HjE8RF1SGECFd0vT3y4FcJYfPhYjdHi8DCOs60YHfGqPH:jFd0vTJRYjNi8Di6EqPH
MD5 SHA1 SHA512 SSDEEP

Submit Download

zfbnnf44.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zfbnnf44.cmdline
Size 144B
SHA256 f0e3d672549cd3ed4d92b61939706c8de5825a013fbaf249994e9fde561ee828
MD5 8312efafc6c8fd1b6caa7d266e6c21c4
SHA1 744a1bd542d59c3888451a59dac6a1c108921f44
SHA512 eab785b7e036befde7f6c6416ae71b098361259bfe4446c1f303e8fc9f9bb5618567c16d41c76f3fff6ec9b5f8c87cf6172b64ef4f73f0ef94062970201f7b57
MD5 SHA1 SHA512

Submit Download

memory/4548-255-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

Download

memory/4548-371-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Download

memory/4548-28-0x000000001BB50000-0x000000001BBC4000-memory.dmp

Download

memory/4548-149-0x000000001B780000-0x000000001B7C0000-memory.dmp

Download

memory/4548-150-0x000000001B780000-0x000000001B7BE000-memory.dmp

Download

memory/4548-151-0x0000000000E80000-0x0000000000EAC000-memory.dmp

Download

memory/4548-152-0x0000000000BB0000-0x0000000000BB8000-memory.dmp

Download

memory/4548-153-0x0000000000BB0000-0x0000000000BBA000-memory.dmp

Download

memory/4548-154-0x0000000000E80000-0x0000000000EA4000-memory.dmp

Download

memory/4548-155-0x0000000000E80000-0x0000000000EA8000-memory.dmp

Download

memory/4548-156-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Download

memory/4548-30-0x0000000000BB0000-0x0000000000BBE000-memory.dmp

Download

memory/4548-135-0x0000000000E80000-0x0000000000EA6000-memory.dmp

Download

memory/4548-27-0x0000000000E80000-0x0000000000EB0000-memory.dmp

Download

memory/4548-26-0x0000000000BB0000-0x0000000000BBA000-memory.dmp

Download

memory/4548-170-0x0000000000BB0000-0x0000000000BBA000-memory.dmp

Download

memory/4548-25-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Download

memory/4548-31-0x000000001BB50000-0x000000001BBE4000-memory.dmp

Download

memory/4548-0-0x00007FFDF24C5000-0x00007FFDF24C6000-memory.dmp

Download

memory/4548-24-0x0000000000BC0000-0x0000000000BC8000-memory.dmp

Download

memory/4548-23-0x0000000000BC0000-0x0000000000BC8000-memory.dmp

Download

memory/4548-184-0x0000000000BC0000-0x0000000000BDE000-memory.dmp

Download

memory/4548-32-0x0000000140000000-0x000000014002C000-memory.dmp

Download

memory/4548-121-0x0000000000BC0000-0x0000000000BE0000-memory.dmp

Download

memory/4548-51-0x0000000000BC0000-0x0000000000BD8000-memory.dmp

Download

memory/4548-107-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Download

memory/4548-5-0x000000001B2D0000-0x000000001B2D8000-memory.dmp

Download

memory/4548-4-0x000000001B2C0000-0x000000001B344000-memory.dmp

Download

memory/4548-198-0x0000000000BC0000-0x0000000000BDE000-memory.dmp

Download

memory/4548-65-0x0000000000BC0000-0x0000000000BD6000-memory.dmp

Download

memory/4548-93-0x0000000000BB0000-0x0000000000BB8000-memory.dmp

Download

memory/4548-3-0x000000001B2D0000-0x000000001B2DE000-memory.dmp

Download

memory/4548-2-0x00007FFDF2210000-0x00007FFDF2BB1000-memory.dmp

Download

memory/4548-219-0x0000000000BB0000-0x0000000000BB8000-memory.dmp

Download

memory/4548-228-0x0000000000BB0000-0x0000000000BBA000-memory.dmp

Download

memory/4548-237-0x0000000000BB0000-0x0000000000BBE000-memory.dmp

Download

memory/4548-246-0x0000000000BC0000-0x0000000000BD4000-memory.dmp

Download

memory/4548-79-0x0000000000E80000-0x0000000000EAA000-memory.dmp

Download

memory/4548-264-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Download

memory/4548-281-0x0000000000E80000-0x0000000000EA8000-memory.dmp

Download

memory/4548-306-0x0000000000BB0000-0x0000000000BBA000-memory.dmp

Download

memory/4548-315-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Download

memory/4548-319-0x00007FFDF24C5000-0x00007FFDF24C6000-memory.dmp

Download

memory/4548-322-0x00007FFDF2210000-0x00007FFDF2BB1000-memory.dmp

Download

memory/4548-326-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Download

memory/4548-335-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Download

memory/4548-344-0x0000000000BC0000-0x0000000000BD4000-memory.dmp

Download

memory/4548-353-0x0000000000BC0000-0x0000000000BD8000-memory.dmp

Download

memory/4548-370-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Download

memory/4548-29-0x0000000000BC0000-0x0000000000BE0000-memory.dmp

Download

memory/4548-372-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Download

memory/4548-373-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

Download

memory/4548-374-0x0000000000BB0000-0x0000000000BBE000-memory.dmp

Download

memory/4548-375-0x0000000000E80000-0x0000000000EA2000-memory.dmp

Download

memory/4548-376-0x0000000000BC0000-0x0000000000BDC000-memory.dmp

Download

memory/4548-377-0x0000000000BC0000-0x0000000000BD4000-memory.dmp

Download

memory/4548-378-0x0000000000BC0000-0x0000000000BDA000-memory.dmp

Download

memory/4548-379-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Download

memory/4548-380-0x0000000000BB0000-0x0000000000BBE000-memory.dmp

Download

memory/4548-381-0x0000000000BC0000-0x0000000000BD8000-memory.dmp

Download

memory/4548-382-0x0000000000BC0000-0x0000000000BD2000-memory.dmp

Download

memory/4548-383-0x0000000000BB0000-0x0000000000BBE000-memory.dmp

Download

memory/4548-384-0x0000000000BB0000-0x0000000000BBA000-memory.dmp

Download

memory/4548-393-0x0000000000BB0000-0x0000000000BB8000-memory.dmp

Download

memory/4548-402-0x0000000000BC0000-0x0000000000BDC000-memory.dmp

Download

memory/4548-411-0x0000000000BC0000-0x0000000000BDC000-memory.dmp

Download

memory/4548-420-0x0000000000BB0000-0x0000000000BB8000-memory.dmp

Download

memory/4548-429-0x0000000000BB0000-0x0000000000BB8000-memory.dmp

Download

memory/4548-438-0x0000000000BB0000-0x0000000000BB8000-memory.dmp

Download

memory/4548-447-0x0000000000BB0000-0x0000000000BBE000-memory.dmp

Download

memory/4548-456-0x0000000000BC0000-0x0000000000BD2000-memory.dmp

Download

memory/4548-465-0x0000000000BB0000-0x0000000000BBE000-memory.dmp

Download

memory/4548-474-0x0000000000BB0000-0x0000000000BBA000-memory.dmp

Download

memory/4548-485-0x0000000000E80000-0x0000000000EAA000-memory.dmp

Download

memory/4548-489-0x00007FFDF2210000-0x00007FFDF2BB1000-memory.dmp

Download

memory/4548-495-0x0000000000E80000-0x0000000000EA8000-memory.dmp

Download

memory/4548-504-0x0000000000BC0000-0x0000000000BDE000-memory.dmp

Download

memory/4548-513-0x0000000000E80000-0x0000000000EA6000-memory.dmp

Download

memory/4548-522-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Download

memory/4548-531-0x0000000000BB0000-0x0000000000BBA000-memory.dmp

Download

memory/4548-540-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Download

memory/4548-549-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Download

memory/4548-558-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Download

memory/4548-567-0x0000000000BC0000-0x0000000000BD4000-memory.dmp

Download

memory/4548-576-0x0000000000BC0000-0x0000000000BD8000-memory.dmp

Download

memory/4548-593-0x0000000000BB0000-0x0000000000BBE000-memory.dmp

Download

memory/4548-594-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Download

memory/4548-595-0x0000000000BC0000-0x0000000000BE0000-memory.dmp

Download

memory/4548-596-0x0000000000BC0000-0x0000000000BDA000-memory.dmp

Download

memory/4548-597-0x0000000000BB0000-0x0000000000BBA000-memory.dmp

Download

memory/4548-598-0x0000000000BC0000-0x0000000000BD6000-memory.dmp

Download

memory/4548-599-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

Download

memory/4548-600-0x0000000000BB0000-0x0000000000BBC000-memory.dmp

Download

memory/4548-601-0x000000001B780000-0x000000001B7C3000-memory.dmp

Download

memory/4548-602-0x0000000000BC0000-0x0000000000BDA000-memory.dmp

Download

memory/4548-603-0x0000000000BB0000-0x0000000000BBA000-memory.dmp

Download

memory/4548-1-0x00007FFDF2210000-0x00007FFDF2BB1000-memory.dmp

Download

memory/4548-1035-0x000000001B780000-0x000000001B7C3000-memory.dmp

Download

memory/4548-1037-0x000000001B780000-0x000000001B7C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads